Application of Content Computing in Honeyfarm

1. Application of Content Computing in Honeyfarm • Introduction • Overview of CDN (content delivery network) • Overview of honeypot and honeyfarm • New redirection mechanism in honeyfarm • Possible future extension

2. Introduction • Honeypot and honeyfarm are important security technologies. • Efficient and transparent redirection mechanism is necessary for successful construction of honeyfarm. • Content delivery network (CDN) can be used to implement redirection for honeyfarm.

3. Modifications in CDN to make it suitable for redirection in honeyfarm.

4. Overview of CDN • CDN: • Dedicated network of servers • Deploy throughout the Internet • Fast delivery of web site contents • Four components of CDN: • Surrogate servers • Routers • Request-routing infrastructure (RRI) • Accounting logs

5. Two primary technologies of CDN: • Intelligent wide area traffic management • Direct clients’ requests to optimal site based on topological proximity. • Two types of redirection: DNS redirection or URL rewriting. • Cache • Saves useful contents in cache nodes. • Two cache policies: least frequently used standard and least recently used standard.

6. Overview of honeypot and honeyfarm • Honeypot • A secure resource. • A web site with imitated contents to lure hackers. • To research and explore hackers’ behaviors. • Three types of honeypot: • Low-interaction honeypot. • High-interaction honeypot. • Medium-interaction honeypot.

7. Honeyfarm: • One type of high-interaction honeypot. • Many honeypots deployed throughout the Internet. • Emulates web sites as real as possible. • Currently uses layer 2 VPN to redirect hackers.

8. Requirements of redirection in honeyfarm: • Transparency. • Quick access. • Update. • CDN is able to fulfill requirements of redirection in honeyfarm.

9. New redirection mechanism in honeyfarm • Drawback of layer 2 VPN redirection: • Centralized problem creates latency. • Problems of CDN redirection: • Transparency requirement may not be satisfied. • Comparison of topological proximity in RRI gives rise to a centralized problem.

10. Modifications of CDN to meet the redirection requirements: • Integrating RRI, local DNS server and proxy cache into one single component called redirection server. • All honeypots are organized in CDN architecture. • Redirection servers are organized in a tree structure.

12. Two steps in the handling of hackers: • Identification of potential hackers. • Redirection of identified hackers to the appropriate honeypot.

13. Identification of potential hackers: • Monitoring of unused IP addresses in the intranet. • Using rule-based intrusion detection systems (IDS). • Using firewall. • Identification of potential hackers is done in ‘mid-system’.

14. Workflow of redirection of hackers: • Request from hackers to mid-system to resolve domain name of genuine target is sent to redirection server. • Redirection server returns its own address to mid-system so that subsequent requests will be redirected to redirection server. • Hackers ask mid-system to send contents.

15. Local redirection server asks all leaf redirection servers if requested contents have been emulated in honeyfarm. • If yes, then

17. If no, hackers are kept in the mid-system by giving some limited privilege. • Local redirection server selects nearest honeypot and emulate requested contents. • When emulation completed, IP address of selected honeypot is returned. • Local redirection server gets contents from the honeypot and disguise them as if they are from the genuine target. • Emulated contents are sent to mid-system.

18. Advantages of the new redirection mechanism: • Transparency - the modification of the requested contents and identification of the hackers in the mid-systems can ensure transparency. • Quick access - The distribution of comparing the topological proximity and constructing the honeyfarm in a CDN architecture increase the speed for the honeyfarm to select the best honeypot for content delivery. • Update - the update approach of CDN can make sure that the information emulated in the honeyfarm can be updated in time.

19. Possible future extension • Performance issues of the redirection mechanism. • Issue of proxy cache. • Combining URL rewriting and DNS-based redirection.

20. Thank you!

21. Q & A