Jonas Pfoh, Daniel Angermeier Honeynet Jonas Pfoh, Daniel Angermeier

Organizational aspects Overview Introduction Definition Goals Tools Outline Organizational aspects Honeynets 2

Jonas Pfoh Daniel Angermeier Introduction M.S. I20, Chair for IT-Security, Prof. Dr. Eckert Virtual machine introspection and intrusion detection methods Daniel Angermeier Dipl.-Inf. Malware Recognition Using Clustering and Classification Techniques Honeynets 3

Honeynet: network of honeypots Definition „A honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource.“ [1] Honeynet: network of honeypots Honeynets 4

Testbed for security tools Goals Intrusion detection Analyzing attacks Harvesting malware Testbed for security tools Honeynets 5

VMware Server tcpdump Wireshark Tools Virtualization for honeypot machines Isolation between honeynet and maintenance network Virtual machines easily restorable tcpdump Raw packet capturing for analysis Wireshark Packet analysis Honeynets 6

iptables Snort Snorby Tools Linux kernel firewall administration IDS Categorization Snorby Convenient interface to Snort event database Honeynets 7

Week 1: Virtualization and architecture Week 2: Honeynet configuration Outline Week 1: Virtualization and architecture Week 2: Honeynet configuration Week 3: Firewall Week 4: Monitoring Week 5: Monitoring in action and setup presentations Honeynets 8

Week 6: Setup presentations continued Outline Week 6: Setup presentations continued Week 7: Malware session and “opening the floodgates” Week 8: An attacker's perspective Week 9+: Analysis phase Week 13: Final presentations Honeynets 9

Organizational aspects Lab tasks Graded homework to be submitted via email to: honeynet-homework@sec.in.tum.de Mailing list: honeynet-praktikum@sec.in.tum.de Honeynets 10

Organizational aspects Grading: Participation and lab tasks 10% Graded homework 25% Midterm presentation 25% Final presentation and result 40% Presentations: 20% style, 80% content 0 points in any aspect makes 0 total Honeynets 11

Thanks for your attention! Literature [1] Michael Vrable , Justin Ma , Jay Chen , David Moore , Erik Vandekieft , Alex C. Snoeren , Geoffrey M. Voelker , Stefan Savage, Scalability, fidelity, and containment in the potemkin virtual honeyfarm, Proceedings of the twentieth ACM symposium on Operating systems principles, October 23-26, 2005, Brighton, United Kingdom. Honeynets 12