Using rootkits hiding techniques to conceal honeypot functionality

Maryam Mohammadzad

doi:10.1016/j.jnca.2023.103606

2023-05-01

PRE

Maryam Mohammadzad

Jaber Karimpour *

DOI：10.1016/j.jnca.2023.103606

原文链接

原文求助

摘要

En 中文

Honeypot is one of the existing technologies in the area of computer network security. The goal of Honeypot is to create a tempting target for the attacker. The system that is considered as a Honeypot in the network includes the services and functions of a real system that the attacker sees as a normal system and enters for exploitation. In this way, Honeypot can monitor the behaviors, patterns, and tools used in various attacks. Certainly, if the intelligent attacker realizes the existence of this trap in the target network, he can design ways to bypass it. In this case, Honeypot practically loses its effectiveness. Therefore, the issue of hiding Honeypot is one of the primary challenges in this field. In this paper, a solution to this problem is presented. In the present paper, Honeypot is concealed using the concealment techniques used in Rootkits. We use application examples and theoretical analysis results to show that the proposed Honeypots concealment approach is strong against existing kernel-based Honeypots detection methods. Sebek, VMScope, and Qebek are three Honeypots that we choose for comparison purposes. The proposed Honeypot has been compared with them in virtualization, memory usage, and kernel modification. The experimental results show that the proposed hidden Honeypot in addition to low kernel modification has no track in the memory. Also, the proposed Honeypot does not use virtualization. It can successfully be concealed in the kernel of the target system without any effect on the target system. We also implemented the proposed algorithm on the example network and test all Sebek's detection methods on it. The experimental results show that the proposed kernel-based approach can bypass these detection methods.

Keyword:

Computer network

Cyber-attacks

Honeypot

Intrusion detection system

Rootkit

Security