ScriptGen: An Automated Script Generation Tool for honeyd
Friday, February 10. 2006
At the 21st Annual Computer Security Applications Conference (ACSAC 2005) back in December 2005, several people from Eurecom presented a paper about automated script generation for honeyd.
The paper entitled "ScriptGen: an automated script generation tool for honeyd" by Corrado Leita, Ken Mermoud, and Marc Dacier presents a tool to generate scripts that can then be used together with honeyd. The basic steps of the tools are:
The results are promising and can presumably help to easily build new scripts for honeyd. In overall, this tool is similar to HoneyBee. Honeybee can also automatically create new honeyd scripts, but relies on a scanner to actively learn the characteristics of a protocol.
Abstract:
Honeyd is a popular tool developed by Niels Provos that offers a simple way to emulate services offered by several machines on a single PC. It is a so called low interaction honeypot. Responses to incoming requests are generated thanks to ad hoc scripts that need to be written by hand. As a result, few scripts exist, especially for services handling proprietary protocols. In this paper, we propose a method to alleviate these problems by automatically generating new scripts. We explain the method and describe its limitations. We analyze the quality of the generated scripts thanks to two different methods. On the one hand, we have launched known attacks against a machine running our scripts; on the other hand, we have deployed that machine on the Internet, next to a high interaction honeypot during two months. For those attackers that have targeted both machines, we can verify if our scripts have, or not, been able to fool them. We also discuss the various tuning parameters of the algorithm that can can be set to either increase the quality of the script or, at the contrary, to reduce its complexity.
The paper entitled "ScriptGen: an automated script generation tool for honeyd" by Corrado Leita, Ken Mermoud, and Marc Dacier presents a tool to generate scripts that can then be used together with honeyd. The basic steps of the tools are:
- Deploy a honeypot and record all network traffic
- Build a state machine based on the captured data
- Simplify the state machine and generate a corresponding honeyd script
The results are promising and can presumably help to easily build new scripts for honeyd. In overall, this tool is similar to HoneyBee. Honeybee can also automatically create new honeyd scripts, but relies on a scanner to actively learn the characteristics of a protocol.
Abstract:
Honeyd is a popular tool developed by Niels Provos that offers a simple way to emulate services offered by several machines on a single PC. It is a so called low interaction honeypot. Responses to incoming requests are generated thanks to ad hoc scripts that need to be written by hand. As a result, few scripts exist, especially for services handling proprietary protocols. In this paper, we propose a method to alleviate these problems by automatically generating new scripts. We explain the method and describe its limitations. We analyze the quality of the generated scripts thanks to two different methods. On the one hand, we have launched known attacks against a machine running our scripts; on the other hand, we have deployed that machine on the Internet, next to a high interaction honeypot during two months. For those attackers that have targeted both machines, we can verify if our scripts have, or not, been able to fool them. We also discuss the various tuning parameters of the algorithm that can can be set to either increase the quality of the script or, at the contrary, to reduce its complexity.
Continue reading "ScriptGen: An Automated Script Generation Tool for honeyd"
".
