Clandestine cell based honeypot networks
Authors: Yucel, C., Koltuksuz, A. and Yagci, H.
Journal: European Conference on Information Warfare and Security, ECCWS
Volume: 2016-January
Pages: 295-302
eISSN: 2048-8610
ISSN: 2048-8602
Abstract:A Clandestine Cell is a type of an intelligence organization where a cell only knows the immediate superior and the associated members of itself. This kind of organizational structure is used by intelligence agencies throughout the world to provide security against a breach, thus ensuring the safety of the members. This well-known intelligence organization is applied to solve an advanced cyber security issue. A relatively new kind of a cyber threat known as an Advanced Persistent Threat (APTs) has been around for some time now, Stuxnet being the very first identified. There are several points to consider when identifying the characteristics of an APT, such as the aim, its interactions with Internet, way of collecting information, operations they do disrupt and concealment mechanisms utilized. An important aspect is whether it is statistically analyzable or dynamically identifiable, that its communication patterns need to be inspected to identify the characteristics. The traces of an APT might be identified this way. In this research, a honeypot network with a communication policy based on a clandestine cell is introduced. Each honeypot only knows a hub. And a hub only knows the main malware analysis server. By utilizing this approach, the communications are hidden from possible attackers without compromising the main server. In each honeypot server, dead-ends are created and implemented in the honeypot servers. Advantages and ramifications are discussed regarding the types of malware. It is aimed to create yet another taxonomy of malware regarding the network activities as they are being trapped by our introduced honeypot network. A clandestine cell format is one of its kind within organizations. This is the very first time that such kind of format is being applied to honeypot design for APT hunting. This is the paper in which an intelligence organizational structure meets with a network architecture in order to solve a very hard to crack cyber security problem. The idea itself is a new and untried one.
Source: Scopus
Clandestine Cell Based Honeypot Networks
Authors: Yucel, C., Koltuksuz, A. and Yagci, H.
Journal: PROCEEDINGS OF THE 15TH EUROPEAN CONFERENCE ON CYBER WARFARE AND SECURITY (ECCWS 2016)
Pages: 295-302
Source: Web of Science (Lite)