Method for generating honeypot

Abstract

A method for generating a honeypot. According to various embodiments, there is provided a method for generating a honeypot for a target system, comprising: determining a service and a protocol supported by a target system to be emulated via a network interface by sending a request for a plurality of services to the target system; determining a honeypot type and a configuration for the selected honeypot type, the honeypot type being capable of providing the determined service and supporting the determined protocol when the honeypot type is configured with the selected configuration; and generating a honeypot of the determined honeypot type having the determined configuration.

Description

Technical Field

[0001] The present disclosure relates to a method for generating a honeypot. Background Art

[0002] The number of networked data processing devices, including embedded devices, is increasing rapidly. An important aspect of all these devices - whether server computers in the Internet or control devices in the automotive or IoT sector - is product security. Honeypots are imitations of such valuable (target) systems, which are used to attract attackers and gain information about their attack strategies and goals. Especially in corporate IT, honeypots are tools established for threat analysis and are also used in the field of (Industrial) Internet of Things ((I)IoT). Although honeypots are very useful tools for supplementing network security strategies, their implementation for specific needs and the corresponding target systems requires a lot of manual work by experts.

[0003] Therefore, it would be desirable to be able to more easily provide (and especially configure) a suitable honeypot for a given target system. Summary of the invention

[0004] According to different embodiments, a method for generating a honeypot for a (pre-given) target system is provided, the method comprising: determining the services provided and the supported protocols by the target system to be imitated via a network interface by sending requests for multiple services to the target system (for example, port scan requests such as service requests, synchronization packets, NULL packets, Fin scan packets, etc., to which the target system may respond), determining a honeypot type (for example, a honeypot architecture) and a configuration for the selected honeypot type, wherein when the honeypot type is configured with the selected configuration, the honeypot type can provide the determined services and support the determined protocols, and generating a honeypot of the determined honeypot type with the determined configuration.

[0005] The above method can realize automatic generation of a low-interaction honeypot for a black-box target system, that is, for example, without requiring the source code of the software running on the target system.

[0006] The automatic generation (including automatic configuration) is not limited to a specific network service or protocol. The black box approach as described in the above method allows derivation without access to the source code or internal structure of the target system. Only network access to the target system is required. This makes it possible to provide honeypot services to operators of target systems who do not want to reveal the internal structure of their (target) systems. The black box approach ensures that the honeypot can be derived without prior knowledge of the honeypot structure and device-specific knowledge.

[0007] Since the generation of a honeypot is based on the knowledge gained by observing (scanning) the target system from the outside (and, for example, does not require understanding the internal functions or structure of the target system (unless it cannot be inferred from the results of the scan)), the above approach can be regarded as black-box generation of a honeypot.

[0008] Various embodiments are presented below.

[0009] Embodiment 1 is a method for generating a honeypot (for a predetermined target system) as described above.

[0010] Embodiment 2 is a method according to embodiment 1, wherein at least a portion of the request is a port scan packet.

[0011] Performing a port scan can be an effective way to determine the services supported and the protocols used for them.

[0012] Embodiment 3 is a method according to embodiment 1 or 2, wherein a confidentiality standard is checked on information about the target system, and the honeypot is generated such that the honeypot does not contain information to be kept confidential according to the confidentiality standard.

[0013] The honeypot generating device may thus filter (by scanning, ie sending a request) or obtain information from other sources, and generate a honeypot based on the filtered information (ie the information that has not been filtered out).

[0014] Embodiment 4 is a method according to one of embodiments 1 to 3, wherein a Boolean expression is determined based on the determined services and supported protocols provided by the target system to be emulated, the honeypot is to satisfy the Boolean expression, and the honeypot type and configuration are determined so as to satisfy the Boolean expression.

[0015] This allows efficient and automatic selection of honeypot types and configurations (eg, by a selection tool running on the honeypot generation device parsing the Boolean expression accordingly, ie, selecting a honeypot type from a honeypot library and determining a configuration for it).

[0016] Embodiment 5 is a data processing system having a honeypot generating device, wherein the data processing system is configured to execute the method described in any one of embodiments 1 to 4.

[0017] Embodiment 6 is a computer program having instructions, which, when executed by a processor, cause the processor to perform the method according to one of embodiments 1 to 4.

[0018] Embodiment 7 is a computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform the method according to one of embodiments 1 to 4. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In the figures, like reference numerals generally refer to the same parts in completely different views. These figures are not necessarily to scale, where instead generally emphasis is placed on the representation of the principles of the present invention. In the following description, various aspects are described in conjunction with the following figures.

[0020] Figure 1 A computer network is shown.

[0021] Figure 2 The diagram illustrates the generation of a honeypot according to one embodiment.

[0022] Figure 3 A flow chart is shown representing a method for generating a honeypot for a target system according to one embodiment. DETAILED DESCRIPTION

[0023] The following detailed description relates to the accompanying drawings, which are used to illustrate the specific details and aspects of the present disclosure in which the present invention can be implemented. Other aspects can be used, and structural, logical and electrical modifications can be made without departing from the scope of protection of the present invention. Different aspects of the present disclosure are not necessarily mutually exclusive, because some aspects of the present disclosure can be combined with one or more other aspects of the present disclosure to form new aspects.

[0024] Various examples are described in more detail below.

[0025] Figure 1 A computer network 100 is shown. The computer network 100 comprises a plurality of data processing devices 101-105 which are connected to one another via a communication connection 106. The data processing devices 101-105 comprise, for example, a server computer 101, a control device 102 and user terminals 103,104.

[0026] The server computer 101 provides different services, such as web pages, bank portals, etc. The control device 102 is, for example, a control device for a robot device, such as a control device in an automatic vehicle. Therefore, the server computer 101 and the control device 102 meet different tasks, and the server computer 101 or the control device 102 can usually be accessed from the user terminal devices 103, 104. This is especially true when the server computer 101 provides functionality to the user, such as a bank portal. But the control device 102 can also be accessed from the outside (for example, in order to configure it). Depending on the tasks of the server computer 101 or the control device 102, they may store security-related data and perform security-related tasks. Therefore, they must be protected from attackers. For example, an attacker using one of the user terminal devices 104 may obtain confidential data (such as keys) through a successful attack, manipulate accounts, or also manipulate the control device 102 to cause an accident.

[0027] One security measure against such attacks is a so-called honeypot 106 (which is implemented by one of the data processing devices 105). The honeypot is supposed to provide a functionality and therefore serves as a bait to attract potential attackers. However, the honeypot is isolated from confidential information or critical functionality, so that attacks on it are carried out in a controlled environment and the risk of affecting the actual functionality is minimized. In this way, the honeypot enables the acquisition of knowledge of attacks on a target system (e.g. one of the server computers 101 or one of the control devices 102) and thus of threat scenarios, which can be responded to by implementing appropriate measures on the target system without the attack endangering the target system.

[0028] Gaining knowledge of threat scenarios for a specific device or product is a challenging task. Handing over a real system to an attacker to study attack paths can provide a wealth of information. However, sacrificing real devices is usually not an option - such an environment may be abused for subsequent attacks or is large in number and expensive to maintain. A honeypot is a computer program that mimics a target system (i.e., a typically "valuable" device) to attract attackers. Low-interaction honeypots only mimic network-related services and monitor connection or login attempts. Honeypots are used in enterprise IT and the Internet of Things (IoT), and the increase in the number of connected devices in the automotive sector indicates a similar trend. Although low-interaction honeypots are a useful tool for monitoring (malicious) interest in specific devices, it is laborious to generate honeypots for different devices.

[0029] According to various embodiments, a method is therefore provided that enables automatic determination of a suitable honeypot (i.e., for example, a suitable honeypot architecture and configuration thereof) to simulate a target system. This is achieved by the following method: a honeypot generation device scans the target system from the outside, and thereby determines the externally visible characteristics of the target system, in particular the services provided via its network interface and the supported protocols, and generates a honeypot accordingly. Therefore, according to various embodiments, a low-interaction honeypot can be efficiently generated for a target system without manual implementation.

[0030] Figure 2 The diagram illustrates the generation of a honeypot according to one embodiment.

[0031] The selection of the honeypot architecture and the determination of the configuration thereof are performed by a honeypot generating device (which implements a "honeypot agent" A), which corresponds, for example, to one of the user terminal devices 104 (for example, a computer used by a user (such as a system administrator) to configure the honeypot 106 and to instruct the data processing device 105 to provide the honeypot 106 thus configured).

[0032] First, Honeypot Agent A scans the target system 201 from the outside (i.e., via the network interface of the target system 201, i.e., the part visible through the network interface). Figure 2 In the figure, "VaT" is used (standing for "valuable target"). Here, the honeypot agent identifies all services NFSx provided by the target system 201 to the outside (i.e., other data processing devices in the computer network 100), and creates a scan result SR. The honeypot agent A forms a Boolean expression BE based on the scan result, which contains the requirements for the honeypot to be generated (for example, which services and / or protocols the honeypot should support, because these services and / or protocols are identified in the scan, that is, the identified services are converted into Boolean expressions). The honeypot agent A selects a suitable honeypot 202 that satisfies the Boolean expression BE (i.e., a suitable honeypot architecture, that is, a suitable honeypot "type", such as a specific version number). For example, the honeypot is selected based on the services and / or protocols it provides. The honeypot agent A also uses the scan results to derive the configuration conf, and uses the configuration to configure the selected honeypot 202.

[0033] A honeypot 203 is then generated (e.g., by corresponding instructions from the honeypot generating means to the data processing means 105). According to its architecture (i.e. its type) 202 and its configuration, the honeypot provides (network) services m_NFSx detected in the scan, which services mimic services running on (and provided by) the target system 201.

[0034] Scanning the target system through the honeypot proxy A can be achieved with the help of network and vulnerability scanners such as Nmap and OpenVas. These scanners usually try to identify specific versions of network protocols to find known security vulnerabilities. In this case, the information obtained in this way can be used to select and configure the honeypot (including its services).

[0035] The selection of the honeypot (or honeypots) is performed as described above based on a Boolean expression containing all the properties that the honeypot should satisfy. For example, a Boolean expression for a honeypot that can mimic MQTT, OpenSSH version 7.1, and HTTP has the following form:

[0036] MQTT AND(OpenSSH_V7.10R SSH_configurable)AND http.

[0037] A honeypot (ie, a honeypot schema or a honeypot type) whose properties make the expression evaluate to true is selected as a suitable honeypot.

[0038] When the honeypot agent A selects a honeypot, it creates a configuration conf for the selected honeypot, so that the configuration contains the details of all services to be emulated (or the services satisfy the details). This includes, for example, the network port where the service is running, the banner and headers that identify the service externally, and the protocol specifications (for example, allowed login attempts). The configuration can be created in any suitable text format, such as JSON, yaml, or XML. A possible configuration for HTTP is as follows:

[0039]

[0040] The honeypot agent determines all information in the configuration when scanning the target system 201. Therefore, the honeypot 203 (and in particular the services emulated by it) can be configured so that the honeypot 203 accurately emulates the scanned target system.

[0041] In summary, according to different embodiments, a method is provided as in Figure 3 The method shown in .

[0042] Figure 3 A flow chart is shown which illustrates a method for generating a honeypot for a (predefined) target system according to one embodiment.

[0043] In 301, the services and supported protocols provided by the target system to be emulated via the network interface are determined by sending requests for multiple services to the target system (for example, port scan requests, such as service requests, synchronization packets, NULL packets, Fin scan packets, etc., to which the target system may respond).

[0044] At 302 , a honeypot type (eg, honeypot architecture) and a configuration for the selected honeypot type are determined that enables the honeypot type to provide determined services and support determined protocols when configured with the selected configuration (ie, such that the honeypot type) is configured with the selected configuration.

[0045] In 303 , a honeypot of the determined honeypot type is generated using the determined configuration (ie, the determined honeypot type is configured by using the determined configuration).

[0046] Figure 3The method can be performed by one or more computers having one or more data processing units. The term "data processing unit" can be understood as any type of entity capable of implementing the processing of data or signals. For example, data or signals can be processed according to at least one (i.e., one or more) specific functions performed by the data processing unit. The data processing unit may include an analog circuit, a digital circuit, a logic circuit, a microprocessor, a microcontroller, a central unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), an integrated circuit of a programmable gate array (FPGA), or any combination thereof, or may be composed of an analog circuit, a digital circuit, a logic circuit, a microprocessor, a microcontroller, a central unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), an integrated circuit of a programmable gate array (FPGA), or any combination thereof. Any other way to implement the various functions described in more detail herein may also be understood as a data processing unit or a logic circuit device. One or more of the method steps described in detail herein may be performed (e.g., implemented) by a data processing unit through one or more specific functions, which are performed by the data processing unit.

[0047] Therefore, the method according to various embodiments is in particular computer-implemented.

Claims

1. A method for generating a honeypot (106, 203) for a target system (201), comprising: Determining (301) services and supported protocols provided by the target system (201) to be emulated via a network interface by sending requests for a plurality of services to the target system (201); determining (302) a honeypot type (202) and a configuration for the selected honeypot type (202), the honeypot type being capable of providing the determined service and supporting the determined protocol when the honeypot type is configured with the selected configuration; as well as A honeypot (106, 203) of a determined honeypot type (202) having a determined configuration is generated (303).

2. The method of claim 1, wherein at least a portion of the request is a port scan packet.

3. The method according to claim 1 or 2, wherein a confidentiality criterion is checked on the information about the target system (201), and the honeypot (106, 203) is generated such that it does not contain information to be kept confidential according to the confidentiality criterion.

4. A method according to any one of claims 1 to 3, wherein a Boolean expression that the honeypot (106, 203) should satisfy is determined based on the services and supported protocols provided by the target system (201) to be emulated, and the honeypot type (202) and the configuration are determined so that the Boolean expression is satisfied.

5. A data processing system comprising a honeypot generating device (104, 201), wherein the honeypot generating device is configured to execute the method according to any one of claims 1 to 4.

6. A computer program having instructions which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 4.

7. A computer readable medium storing instructions which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 4.

Images