Advanced Cowrie Configuration to Increase Honeypot Deceptiveness - ICT Systems Security and Privacy Protection Access content directly
Conference Papers Year : 2021

Advanced Cowrie Configuration to Increase Honeypot Deceptiveness

Warren Z. Cabral
  • Function : Author
Craig Valli
  • Function : Author
  • PersonId : 1154386
Leslie F. Sikos
  • Function : Author
  • PersonId : 1154387
Samuel G. Wakeling
  • Function : Author
  • PersonId : 1154388

Abstract

Cowrie is a medium-interaction SSH, and Telnet honeypot used to record brute force attacks and SSH requests. Cowrie utilizes a Python codebase, which is maintained and publicly available on GitHub. Since its source code is publicly released, not only security specialists but cybercriminals can also analyze it. Nonetheless, cybersecurity specialists deploy most honeypots with default configurations. This outcome is because modern computer systems and infrastructures do not provide a standard framework for optimal deployment of these honeypots based on the various configuration options available to produce a non-default configuration. This option would allow them to act as effective deceptive systems. Honeypot deployments with default configuration settings are easier to detect because cybercriminals have known scripts and tools such as NMAP and Shodan for identifying them. This research aims to develop a framework that enables for the customized configuration of the Cowrie honeypot, thereby enhancing its functionality to achieve a high degree of deceptiveness and realism when presented to the Internet. A comparison between the default and configured deployments is further conducted to prove the modified deployments’ effectiveness.
Fichier principal
Vignette du fichier
512098_1_En_21_Chapter.pdf (358.55 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03746028 , version 1 (04-08-2022)

Licence

Attribution

Identifiers

Cite

Warren Z. Cabral, Craig Valli, Leslie F. Sikos, Samuel G. Wakeling. Advanced Cowrie Configuration to Increase Honeypot Deceptiveness. 36th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2021, Oslo, Norway. pp.317-331, ⟨10.1007/978-3-030-78120-0_21⟩. ⟨hal-03746028⟩
139 View
20 Download

Altmetric

Share

Gmail Facebook X LinkedIn More