低対話型ハニーポットとダークネットの関連付けによる Title新たなスキャン活動の検知手法の検討 ( インターネットアーキテクチャ )

Μέγεθος: px

Εμφάνιση ξεκινά από τη σελίδα:

Download "低対話型ハニーポットとダークネットの関連付けによる Title新たなスキャン活動の検知手法の検討 ( インターネットアーキテクチャ )"

Φοίβη Παππάς
5 χρόνια πριν
Προβολές:

(2017), 117(294): 13-18 Issue Date 2017-11-10 URL http://hdl.handle.

1 低対話型ハニーポットとダークネットの関連付けによる Title新たなスキャン活動の検知手法の検討 ( インターネットアーキテクチャ ) Author(s) 秋吉, 亮 ; 小谷, 大祐 ; 岡部, 寿男 Citation 電子情報通信学会技術研究報告 = IEICE technical re 信学技報 (2017), 117(294): Issue Date URL Right 2017 電子情報通信学会 Type Journal Article Textversion publisher Kyoto University

2 一般社団法人電子情報通信学会信学技報 THE INSTITUTE OF ELECTRONICS, IEICE Technical Report INFORMATION AND COMMUNICATION ENGINEERS IA ( ) Lurker,, Investigation of A Method for Detecting New Scanning Activities by Correlating Low-Interaction Honeypots with Darknet Ryoh AKIYOSHI, Daisuke KOTANI, and Yasuo OKABE Graduate School of Informatics, Kyoto University Yoshida-Honmachi, Sakyo-ku, Kyoto, JAPAN Academic Center for Computing and Media Studies, Kyoto University Yoshida-Honmachi, Sakyo-ku, Kyoto, JAPAN aky@net.ist.i.kyoto-u.ac.jp, {kotani,okabe}@media.kyoto-u.ac.jp Abstract In this paper, we discuss a method for detecting new scanning activities by using low-interaction honeypots and darknet. High-interaction honeypot can obtain rich information, however there is a problem in implementation difficulty from a viewpoint of security. In contrast, although low-interaction honeypot can obsarve only limited attacks, that can be implemented relatively safely. Then we investigate a method to associate data obtained from low-interaction honeypot with those from darknet. With this, new scanning activities can be detected automatically, as it is possible to get rich information safely and efficiently. In this paper, we conducted the experimental tests which classify data obtained by Lurker based on the payloads and its consideration. Key words Darknet, Low-interaction honeypot, Classification 1. Web IDS (Intrusion detection system) Snort [1] Bro [2] IoT Mirai IDS IP IP [3] IP 13 This article is a technical report without peer review, and its polished and/or extended version may be published elsewhere. Copyright 2017 by IEICE

3 IP 1 TCP Honeynet Project [4] OS SSH Cowrie [5] (BLACKHOLE, EPMAP, FTP, HTTP, MEMCACHE, MIRROR, MQTT, MSSQL, MYSQL, PPTP, SIP, SMB, TFTP, UPNP) Dionaea [6], TCP SYN SYN + ACK ICMP Echo ICMP Reply Lurker [7] Lurker Lurker TCP SYN TCMP Echo 1 Cowrie Dionaea Lurker Lurker Correlation Analysis System [8] Honeypot Darknet Macro analysis Sysmtem (MacS), Micro analysis System (MicS), Network and malware enchaining System (NemeSys), Incident Handling System (IHS) 4 MacS ICMP SYN MicS API URL API NemeSys MacS MicS IHS GUI Hoepers CSIRT [12] 1 Firewall Hogwash Forensics IDS 14

4 [byte] 1 [byte] 2 [byte] [2] [2, 3] [2, 3, 4] [3, 4, 5] [4, 5] [5] 9 9 [9] 1 1 PCNAD [11] PCNAD n-gram(n =1) l t m d m d m t Cowie [9] 2 [10] gram 1-gram l t 1 l t =2 2 1 l t 1 6 l t 2 l t 2 (1) m d n m d (x, y) = x k y k (1) k=1 m d m t 3. 2 Lurker 15

5 ID TTL srcip, dstip ([TCP, UDP, ICMP]) srcport, dstport (TCP, UDP ) seqnum (TCP ) acknum (TCP ) flags (TCP ) win (TCP ) opts (TCP ) (TCP ) Lurker Lurker IP 1 12 / Lurker , 3 2 SSH 3 HTTP SSH PUTTY 3 SSH libssh 3 NULL P d,l (d = 80) 80 1-gram P d,l l 5 m d m t m t = payload_length 0.2 (2) (m d! = 0)&&(m d <= m t) (2) 1, HTTP phpmyadmin phpmyadmin (Lurker) Lurker [1] Snort - Network Intrusion Detection & Prevention System, (October, 2017) [2] The Bro Network Security Monitor, (October, 2017) [3] Harrop, Warren, and Grenville Armitage. "Defining and evaluating greynets (sparse darknets)." Local Computer Networks, th Anniversary. The IEEE Conference on. IEEE, [4] The Honeynet Project, (October, 2017) [5] micheloosterhof/cowrie: Cowrie SSH/Telnet Honeypot, (October, 2017) [6] DinoTools/dionaea: Home of the dionaea honeypot, (October, 2017) [7] m-mizutani/lurker: Lurker monitors an incoming network TCP SYN packet to invalid port number, and will respond a TCP SYN-ACK packet to collect packet payload from attacker, [8] Nakao, Koji, et al. "Practical correlation analysis between scan and malware profiles against zero-day attacks based on darknet monitoring." IEICE TRANSACTIONS on Information and Systems 92.5 (2009):

6 2 SSH 3 HTTP [9] Cowie, Bradley, and Barry Irwin. "Data classification for artificial intelligence construct training to aid in network incident identification using network telescope data."âăproceedings of the 2010 Annual Research Conference of the South African Institute of Computer Scientists and Information Technologists. ACM, [10], et al. "." 17

7 Length: Manhattan Distance: HEAD / HTTP/ HEAD / HTTP/ ==== (2014): [11] Thorat, Sandeep A., et al. "Payload content based network anomaly detection." Applications of Digital Information and Web Technologies, ICADIWT First International Conference on the. IEEE, [12] Hoepers, Cristine, Klaus Steding-Jessen, and Antonio Montes. "Honeynets Applied to the CSIRT Scenario." Proceedings of the 15th Annual Computer Security Incident Handling Conference Length: Manhattan Distance: GET /phpmyadmin all-languages/scripts/setup.php HTTP/1.1 5 Accept: */* 6 Accept-Language: en-us 7 Accept-Encoding: gzip, deflate 8 User-Agent: ZmEu 9 Host: Connection: Close GET /phpmyadmin all-languages/scripts/setup. php HTTP/ Accept: */* 16 Accept-Language: en-us 17 Accept-Encoding: gzip, deflate 18 User-Agent: ZmEu 19 Host: Connection: Close ==== 18

Σχετικά έγγραφα

Connected Threat Defense

Connected Threat Defense συγκοινωνούντα συστήματα προστασίας Χριστόφορος Χριστοφή Διευθύνων Σύμβουλος CHANNEL IT Πριν πέντε χρόνια η ασφάλεια των επιχειρήσεων ήταν ήδη δύσκολη υπόθεση 2 Ο μοντέρνος χώρος