Changes between Version 12 and Version 13 of JINO-1

Timestamp:

Jul 2, 2012, 10:20:07 AM (6 years ago)

Author:

frederic.loulergue@…

Comment:

--

JINO-1

@@ -25 +25 @@
 * 15h30-16h00 '''Pause'''
 
-* 16h00-16h45 '''!HoneyCloud: Elastic Honeypots - On-attack provisioning of high-interaction honeypots''' [[BR]] ''Patrice Clemente''[[BR]]This talk presents !HoneyCloud: a large-scale high-interaction honeypot architecture using a cloud infras- tructure. The talk shows how to setup and deploy on-demand virtualized honeypot hosts on a private cloud. Each attacker is elastically assigned to a new virtual honeypot instance. HoneyCloud offers a high scalability. With a small number of public IP addresses, !HoneyCloud can multiplex thousands of attackers. The attacker can perform malicious activities on the honeypot and launch new attacks from the compromised host. The !HoneyCloud architecture is designed to collect operating system logs about attacks, from various IDS, tools and sensors. Each virtual honeypot instance includes network and especially system sensors that gather more useful information than traditional network oriented honeypots. The paper shows how are collected the activities of attackers into the cloud storage mechanism for further forensics analysis. !HoneyCloud also addresses efficient attacker’s session storage, long term session management, isolation between attackers and authenticity of hosts. Some preliminary results are given about the performance of the honeypot provisioning service.
+* 16h00-16h45 '''!HoneyCloud: Elastic Honeypots - On-attack provisioning of high-interaction honeypots''' [[BR]] ''Patrice Clemente''[[BR]]This talk presents !HoneyCloud: a large-scale high-interaction honeypot architecture using a cloud infras- tructure. The talk shows how to setup and deploy on-demand virtualized honeypot hosts on a private cloud. Each attacker is elastically assigned to a new virtual honeypot instance. !HoneyCloud offers a high scalability. With a small number of public IP addresses, !HoneyCloud can multiplex thousands of attackers. The attacker can perform malicious activities on the honeypot and launch new attacks from the compromised host. The !HoneyCloud architecture is designed to collect operating system logs about attacks, from various IDS, tools and sensors. Each virtual honeypot instance includes network and especially system sensors that gather more useful information than traditional network oriented honeypots. The paper shows how are collected the activities of attackers into the cloud storage mechanism for further forensics analysis. !HoneyCloud also addresses efficient attacker’s session storage, long term session management, isolation between attackers and authenticity of hosts. Some preliminary results are given about the performance of the honeypot provisioning service.
 
 * 16h45-17h30 '''Discussion'''