Int'l Conf. Security and Management | SAM'16 | 299 Using Football Formations in a Honeypot Environment Sebastian Kollmannsperger and Tyrone S. Toland Department of Informatics University of South Carolina Upstate 800 University Way, Spartanburg, SC 29303 [email protected], [email protected] Abstract — Unauthorized access to information continues to be a tools act rather passive. An intrusion detection system is an challenging problem, especially in a time where cyber attacks are example for a detection system. on the rise. Current security measures (e.g., access control systems, firewalls, intrusion detection systems) may not be sufficient to After an intruder has been detected, we have to react. Every protect the information technology (IT) infrastructure from a action in a system gets recorded and stored by one of the resourceful malicious attacker. This paper presents a novel approach to embed a football formation into a Honeypot detection tools. Therefore, also the intruder leaves behind environment. We show how executing football plays in a Honeypot evidences. By analyzing these evidences, we can find out environment can be used to gather information about a malicious how the attacker got in, what the attacker accessed and what attacker. This reconnaissance information can be used to prevent the intruder manipulated. With this information we can take future unauthorized access to sensitive information. We also steps to react adequately. Backup and recovery tools are an discuss of our implementation and provide some results from a example of response tools. proof of concept experiment. We now discuss a tool that can be used to assist in securing a Keywords — Honeypots, Intrusion Detection System, computer system. Information Security A. Honeypots I. INTRODUCTION Compared to other approaches to information security, Information security has been challenging since humans honeypots are a more aggressive and active form of defense began exchanging information. For example, cipher has against malicious attacks [2]. Honeypots are defined in always been discussed in information security. In fact, different ways. Schneier [3] defines a Honeypot as a security ciphers were used to encrypt important messages as far back resource whose value lies in being probed, attacked or as 50 BC [5]. The advent of the computer required stronger compromised. This paper defines a Honeypot as an IT measures to enforce security, which became an even bigger resource with the goal to attract potential malicious challenge with the rise of the Internet. As companies become attackers. That is, any access of the Honeypots is examined inter-connected more and more via the Internet, the and recorded to be used to deter similar attacks from challenge of protecting the infrastructure and information occurring in the future. Contrary to other components of an becomes an even bigger challenge. Nowadays many IT system, it is desired that the Honeypot gets attacked and different defense mechanisms work together to form a secure probed. Since Honeypots are masquerading as sensitive system. Firewalls, encryption tools, access control systems, resource, they do not provide any functionality for an intrusion detection systems as well as other security software organization. Therefore, if a malicious user accesses the contribute to information security in a slightly different way. Honeypot, then this access can be seen as unauthorized access and therefore as an intrusion [2]. Honeypots can be Schneier [3] identifies three tasks of information security categorized as either a production honeypot or a research which are prevention, detection and response. All security honeypot as follows [3][4]: tools can be assigned to either one of these tasks. • Production Honeypot: According to the name, Prevention is the attempt to protect resources from danger these kind of Honeypots are especially used in a and harm. Preparations have to be done, to set up production environment. Their main purpose is to mechanisms that protect the IT. The goal is to make it as gather information for a specific organization about hard as possible, for intruders and hackers to access intrusions. They add value to an organizations resources. Well known prevention tools are firewalls, information security. password protections, encryption tools and digital signatures. • Research Honeypot: These Honeypots are used When prevention is not effective, detection becomes an principally in a research environment to gather important process. With detection, we want to find out if our information about potential attackers. They do not system was compromised and from where. Detection is add value to a specific organization. Information therefore like a monitoring tool. However, it does not from Research Honeypots can be used to find out contribute to the protection of systems, because detection about techniques and resources from attackers ISBN: 1-60132-445-6, CSREA Press © 300 Int'l Conf. Security and Management | SAM'16 | which can help to prepare the production system information collected by a Honeypot, we can for attacks. construct countermeasures to prevent similar attacks from occurring in the future. B. Value of Honeypots It should be noted, that the goal of a Honeypot is not to Honeypots are flexible tools and contribute to each one of prevent attacks, but to detect them. Therefore, a Honeypot the three security aspect as follows [4][3]: should be combined with other security tools (e.g., firewalls, encryption, password protection). • Prevention: Contrary to the belief of the majority, Honeypots can help to prevent attacks because of In this paper we discuss how American football plays can be deception and deterrence. Deception means, that used to gather information about malicious attackers in a potential attackers may waste time and resources on honeypot research environment. In particular, we propose honeypots. Without knowing, attackers interact using various offensive plays to provide valuable with a honeypot that imitates a valuable resource. reconnaissance information to defend sensitive information During this interaction, organizations have the time in an infrastructure. This reconnaissance information can be to react. After all, attacks can be stopped before analyzed and used to defend sensitive information in an even leaking information. Deterrence on the other infrastructure. Our novel approach to mapping football hand is the effect of scaring off attackers because of formations into a honeypot research environment can be the warning effect of Honeypots. When attackers extended to a networked infrastructure. know that an organization uses Honeypots, they may not even try to attack. As we can see, This paper is organized as follows. In Section II, we discuss honeypots contribute to the prevention of attacks in a research Honeypot environment. In Section III, we briefly a certain degree. Nonetheless, traditional prevention describe a simplified football formation. In Section IV, we tools like firewalls are more efficient. show how to map a football formation into a research Honeypot environment. Section V discusses our • Detection: Honeypots have the biggest impact in implementation and results from proof concept experiment. detection. For many organizations, detection is a Section VI concludes the paper. difficult topic. Schneier [3] identifies three challenges when it comes to detection: false II. RESEARCH HONEYPOT ENVIRONMENT positives, false negatives and data aggregation. False positives are mistakenly reported alerts. This Honeypots allow a wide range of application areas. Because happens, when the system interprets normal of their goal to distract and attract attackers, the best way to network traffic as an attack. The opposite false use Honeypots is within an IT infrastructure. The probability negatives are attacks, that the system does not that an attacker interacts with Honeypots are increased by notice. Finally, data aggregation is the struggle to masquerading as sensitive data. collect the data and transform it into valuable information. Common intrusion detection systems In Fig. 1, we illustrate a Honeypot integrated with other struggle in these three aspects. Intrusion detection important and possible sensitive IT resources. Fig. 1 is a systems act like a watchdog over a company’s IT variation of a model in [4]. infrastructure. They monitor the traffic and identify whether an access is authorized or not. Therefore, intrusion detection systems generate a lot of data, resulting in an overload of information. Honeypots however, help us to eliminate these negative aspects. Because every interaction with a honeypot can be seen as unauthorized, honeypots only register these interactions. The problem with data aggregation and false positives can be eliminated. False negatives can still occur, for example if an intrusion does not affect the Honeypot, but this risk can be mitigated by placing the Honeypot in an attracting position. Consequently, Honeypots help us to detect intrusions more effectively. • Response: After an intrusion is detected, response is the next step to take. Honeypots help us to identify evidences via log files. That is, the user can analyze Fig. 1 Honeypot in IT Infrastructure log files that are generated by Honeypots to find out how the attacker gain access to the system. With the ISBN: 1-60132-445-6, CSREA Press © Int'l Conf. Security and Management | SAM'16 | 301 The Honeypot is part of the infrastructure similar to other one player of the