![](bg6.png)
• Snort, for real time traffic analysis of the packet
that are exchanged between the two hosts.
• syslog/SELinux, that is activated in auditing
mode. It enables to monitor all the forbidden in-
teractions that are controled by the standard “tar-
geted” policy.
• Osiris, that monitors any change in the system’s
files and kernel modules.
All the sensor’s logs are saved before killing the VM
for off-line investigation. Furthermore, important sys-
tem files like the user’s
bash_history
,
/dev/shm
,
/tmp
are saved too.
5 CONCLUDING REMARKS
This paper introduces HoneyCloud, a new honey-
pot infrastructure based on cloud computing technics
that enables to deploy a large-scale high interaction
honeyfarm. This new type of honeyfarm provides a
virtualized honeypot host per attacker. HoneyCloud
introduces persistence facilities in order to restore
the homedirectory of the attacker in case of multiple
venues. The architecture lets the attacker exploit any
vulnerability of the honeypot. He may become root
and install malicious software. This is a real advan-
tage as HoneyCloud stores all network and system
logs related to attacker’s session, enabling to finely
study the attacks.
The architecture of HoneyCloud is very scalable,
as it is based on a cloud and can multiplex a few pub-
lic IP to thousands of attackers. Further works will
focus on deploying HoneyCloud on a larger infras-
tructure as the one used here in order to collect attacks
logs during a long period.
REFERENCES
Baecher, P., Koetter, M., Holz, T., Dornseif, M., and Freil-
ing, F. (2006). The Nepenthes platform: An effi-
cient approach to collect malware. In 9th interna-
tional symposium on Recent Advances in Intrusion
Detection (RAID), pages 165–184, Hamburg, Ger-
many. Springer.
Balamurugan, M. and Poornima, B. S. C. (2011). Article:
Honeypot as a service in cloud. IJCA Proceedings on
International Conference on Web Services Computing
(ICWSC), ICWSC(1):39–43. Published by Founda-
tion of Computer Science, New York, USA.
Bousquet, A., Clemente, P., and Lalande, J.-F. (2011).
SYNEMA: visual monitoring of network and system
security sensors. In International Conference on Se-
curity and Cryptography, pages 375–378, S´eville, Es-
pagne.
Briffaut, J., Clemente, P., Lalande, J.-F., and Rouzaud-
Cornabas, J. (2012). Honeypot forensics for system
and network SIEM design. In Advances in Security In-
formation Management: Perceptions and Outcomes,
pages –. Nova Science Publishers.
Chin, W. Y., Markatos, E. P., Antonatos, S., and Ioanni-
dis, S. (2009). HoneyLab: Large-scale honeypot de-
ployment and resource sharing. In NSS’09: Proceed-
ings of the 2009 Third International Conference on
Network and System Security, pages 381–388, Gold
Coast, Queensland, Australia. IEEE Computer Soci-
ety.
Jiang, X. and Xu, D. (2004). Collapsar: a VM-based
architecture for network attack detention center. In
SSYM’04: Proceedings of the 13th conference on
USENIX Security Symposium, pages 2–2, Boston,
MA, USA. USENIX Association.
Leita, C. and Dacier, M. (2008). SGNET: A worldwide
deployable framework to support the analysis of mal-
ware threat models. In EDCC-7 ’08: Proceedings of
the 2008 Seventh European Dependable Computing
Conference, pages 99–109, Kaunas, Lituania. IEEE
Computer Society.
Moore, D., Shannon, C., Voelker, G., and Savage, S. (2004).
Network telescopes: Technical report. CAIDA, April.
Nurmi, D., Wolski, R., Grzegorczyk, C., Obertelli, G., So-
man, S., Youseff, L., and Zagorodnov, D. (2009).
The eucalyptus open-source cloud-computing sys-
tem. In CCGRID ’09: Proceedings of the 2009 9th
IEEE/ACM International Symposium on Cluster Com-
puting and the Grid, pages 124–131, Shangai, China.
IEEE Computer Society.
Provos, N. (2004). A virtual honeypot framework. In
SSYM’04: Proceedings of the 13th conference on
USENIX Security Symposium, Boston, MA, USA.
USENIX Association.
Shimoda, A., Mori, T., and Goto, S. (2010). Sensor in the
dark: Building untraceable large-scale honeypots us-
ing virtualization technologies. In 2010 10th Annual
International Symposium on Applications and the In-
ternet, pages 22–30, Seoul, Korea. IEEE Society.
Spitzner, L. (2003). Honeypots: tracking hackers. Addison-
Wesley Professional.
Vrable, M., Ma, J., Chen, J., Moore, D., Vandekieft, E.,
Snoeren, A. C., Voelker, G. M., and Savage, S. (2005).
Scalability, fidelity, and containment in the Potemkin
virtual honeyfarm. In SOSP ’05: Proceedings of the
twentieth ACM symposium on Operating systems prin-
ciples, pages 148–162, Brighton, United Kingdom.
ACM.
HoneyCloud:ElasticHoneypots-On-attackProvisioningofHigh-interactionHoneypots
439