The HoneyTank: a scalable approach to collect malicious internet traffic

Nicolas Vanderavero, Xavier Brouckaert, Olivier Bonaventure and Baudouin Le Charlier

International Journal of Critical Infrastructures, 2008, vol. 4, issue 1/2, 185-205

Abstract: In this paper, we propose an efficient method for collecting large amounts of malicious internet traffic. The key advantage of our method is that it does not need to maintain any state to emulate TCP services running on a large number of emulated end-systems. We implemented a prototype on the ASAX intrusion detection system and we provide several examples of the malicious activities that were collected on a campus network attached to the internet. We explain how we implemented various protocols in a stateless way. We also discuss how our method can be improved to make an accurate but still stateless emulation of stateful protocols.

Keywords: honeypots; intrusion detection systems; worms; malicious internet traffic; internet attacks; critical infrastructures. (search for similar items in EconPapers)
Date: 2008
References: Add references at CitEc
Citations:

Downloads: (external link)
http://www.inderscience.com/link.php?id=16100 (text/html)
Access to full text is restricted to subscribers.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:ids:ijcist:v:4:y:2008:i:1/2:p:185-205

Access Statistics for this article

More articles in International Journal of Critical Infrastructures from Inderscience Enterprises Ltd
Bibliographic data for series maintained by Sarah Parker ().