Improving network security using honeypots

مقدم أطروحة جامعية

Alami, Muhammad al-Wali

مشرف أطروحة جامعية

Rashidi, Taj al-Din

أعضاء اللجنة

Bin Abbu, Rashid
Husayni, Umar Iraqi
Radwan, Muhammad

الجامعة

جامعة الأخوين

الكلية

كلية الهندسة و العلوم

القسم الأكاديمي

شبكات الحاسوب

دولة الجامعة

المغرب

الدرجة العلمية

ماجستير

تاريخ الدرجة العلمية

2011

الملخص الإنجليزي

With the development of Internet use, the number of network attacks is more and more increasing.

To encounter this risk, several security tools such firewalls and Intrusion Detection Systems were developed to fight against those attacks.

However, these tools do not provide enough information about attackers and their attacks; they are only used to detect and react to attacks.

In other words, they are purely defensive; the enemy has the initiative.

Therefore, to effectively fight against attacks by malicious hackers, it is necessary to understand how they work, what are their motives and the tools that they use.

To achieve that, a new security tool called Honeypot was developed.

Indeed, the concept of a Honeypot is to trap attackers by giving them a vulnerable system to attack.

At this moment, the Honeypot shall collect data silently without preventing the attacker or getting his attention.

The data gathered by the Honeypot will then be analyzed to obtain information on the attackers.

This information can be used by security administrators to take actions to decrease or even stop these attacks.

For example, they may send reports to the owners of the infected machines.

So, in this way, people become aware of network attacks.

In this project, we explored honeynets and deployed Honeyd, one of the most powerful Honeypot tools, in a Linux machine for 10 days for collecting information on attackers and their attacks.

In addition, we developed a PHP-based web interface that queries the data from the MySQL database and produces diagrams in order to help security administrators to easily understand what has happened inside the Honeyd tool.

Such queries could be the current attacks and the top detected attacks with their source IP addresses and country of origin.

Besides, this interface sends alerts via email to administrators about critical attacks.

التخصصات الرئيسية

العلوم الهندسية والتكنولوجية (متداخلة التخصصات)

الموضوعات

• شبكات الحاسوب
• الإجراءات الأمنية
• الهاكرز

عدد الصفحات

74

قائمة المحتويات

• APA
• MLA
• AMA

لغة النص

الإنجليزية

نوع البيانات

رسائل جامعية

رقم السجل

BIM-645194