Authors: David Dagon, Xinzhou Qin, Guofei Gu, Wenke Lee,

1. HoneyStat: Local Worm Detection Using Honeypots Authors:David Dagon, Xinzhou Qin, Guofei Gu, Wenke Lee, Julian Grizzard, John Levine, Henry Owen Publication: 7th International Symposium on Recent Advances in Intrusion Detection (RAID 2004) Presenter:Melvin Rodriguez for CAP 6133, Spring’08

2. HoneyStat: Local Worm Detection Using Honeypots • In general terms, what have you learned or discovered about Honeypots? • What are honeypots ? • Architecture, management, deployment, etc • Are we missing something? • Local network worm detection Next Evolution: Local worm detection

3. HoneyStat: Local Worm Detection Using Honeypots • Honeystat • Local network worm detection • Utilizes worm attack pattern and network events • Memory, Network, and Disk events • Improved event collection and analysis What is Honeystat

4. HoneyStat: Local Worm Detection Using Honeypots • Worm Infection Cycle • Prove / Scan • Memory Buffer overflow – port services (i.e. 135, 444, etc) • A memory event is created • Network connection stays open • Downloads malicious program –TCP/UDP Traffic • Network event is created • Execute malicious instruction to disk – write program to disk, rename or delete file(s), etc • Disk operation is created Combines local network events to detect attacks

5. HoneyStat: Local Worm Detection Using Honeypots • Data captured and analysis • Memory events- memory stack • Network events – outgoing packets • Disk events – delta of file changes • Other information • Host OS / patch level • Trace file of prior network activity Anomaly detection = zero-day worm detection

6. HoneyStat: Local Worm Detection Using Honeypots • Data Analysis • Logistic (Logit) analysis • Uses an equation for evaluating honeypot state, time of event, time relationships and coefficients, and other variables • Explains the changes in honeypots • From asleep to awake • If result is valid is consider an alert • Otherwise result is stored continue monitoring More effective event correlation

7. HoneyStat: Local Worm Detection Using Honeypots Graphic extracted from “Don’t Become a Stat …Use Honeystat” by Justin Miller

8. HoneyStat: Local Worm Detection Using Honeypots • Summary • Address local network worm detection • Uses a more effective event correlation and analysis • Memory, Network, and Disk events • Effective method for zero-day worn detection without prior signature • Conclusion • Improvements over previous worm detection techniques • Trace files, multi vector attacks, alerts • Reduction of false positives • Use of logit analysis • Further research local detection is needed

9. HoneyStat: Local Worm Detection Using Honeypots • Contributions • Local network worn detection method • Provides a very accurate data stream for analysis • Capable to detects zero day worms, for which there is no known signature

10. HoneyStat: Local Worm Detection Using Honeypots • Weaknesses • A local detection strategy must anticipate future worms lacking some of events such as downloading payload, writing to disk • Possible honeypot evasion • Attackers with worms to detect honeypots • Limited ‘false-positive’ sampling size • Unknown effectiveness • Lack of integration with other IDS methods

11. HoneyStat: Local Worm Detection Using Honeypots • How to Improve • More testing needed for analysis of false positives • Additional testing of local network worn detection is needed • Integration with other intrusion detection techniques • New techniques models to analyze large number of data

12. HoneyStat: Local Worm Detection Using Honeypots • Back-Up Slides

14. HoneyStat: Local Worm Detection Using Honeypots Graphic extracted from “Don’t Become a Stat …Use Honeystat” by Justin Miller

15. HoneyStat: Local Worm Detection Using Honeypots