1. Jonas Pfoh, Daniel Angermeier
Honeynet
Jonas Pfoh, Daniel Angermeier

2. Organizational aspects
Overview
Introduction
Definition
Goals
Tools
Outline
Organizational aspects
Honeynets

3. Jonas Pfoh Daniel Angermeier Introduction M.S.
I20, Chair for IT-Security, Prof. Dr. Eckert
Virtual machine introspection and intrusion detection methods
Daniel Angermeier
Dipl.-Inf.
Malware Recognition Using Clustering and Classification Techniques
Honeynets

4. Honeynet: network of honeypots
Definition
„A honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource.“ [1]
Honeynet: network of honeypots
Honeynets

5. Testbed for security tools
Goals
Intrusion detection
Analyzing attacks
Harvesting malware
Testbed for security tools
Honeynets

6. VMware Server tcpdump Wireshark Tools
Virtualization for honeypot machines
Isolation between honeynet and maintenance network
Virtual machines easily restorable
tcpdump
Raw packet capturing for analysis
Wireshark
Packet analysis
Honeynets

7. iptables Snort Snorby Tools Linux kernel firewall administration IDS
Categorization
Snorby
Convenient interface to Snort event database
Honeynets

8. Week 1: Virtualization and architecture Week 2: Honeynet configuration
Outline
Week 1: Virtualization and architecture
Week 2: Honeynet configuration
Week 3: Firewall
Week 4: Monitoring
Week 5: Monitoring in action and setup presentations
Honeynets

9. Week 6: Setup presentations continued
Outline
Week 6: Setup presentations continued
Week 7: Malware session and “opening the floodgates”
Week 8: An attacker's perspective
Week 9+: Analysis phase
Week 13: Final presentations
Honeynets

10. Organizational aspects
Lab tasks
Graded homework to be submitted via to:
Mailing list:
Honeynets

11. Organizational aspects
Grading:
Participation and lab tasks 10%
Graded homework 25%
Midterm presentation 25%
Final presentation and result 40%
Presentations: 20% style, 80% content
0 points in any aspect makes 0 total
Honeynets

12. Thanks for your attention!
Literature
[1] Michael Vrable , Justin Ma , Jay Chen , David Moore , Erik Vandekieft , Alex C. Snoeren , Geoffrey M. Voelker , Stefan Savage, Scalability, fidelity, and containment in the potemkin virtual honeyfarm, Proceedings of the twentieth ACM symposium on Operating systems principles, October 23-26, 2005, Brighton, United Kingdom.
Honeynets