Method for creating a honeypot

Abstract

According to various embodiments, a method for creating a honeypot for a target system is provided, comprising determining services and supported protocols provided by a target system to be imitated via a network interface by sending requests to the target system for a variety of services, determining a honeypot type and a configuration for the selected honeypot type, which, when configured with the selected configuration, can provide the determined services and support the determined protocols, and creating a honeypot of the determined honeypot type with the determined configuration.

Description

[0001] The present disclosure relates to methods for creating a honeypot.

[0002] The number of networked computing devices (including embedded devices) is increasing rapidly. A key aspect of all these devices—be they server computers on the internet or control devices in the automotive or IoT sector—is product security. Honeypots are decoys that mimic such valuable (target) systems to lure attackers and gather information about their attack strategies and objectives. Honeypots are an established threat analysis tool, especially in corporate IT, and they are now also being used in the area of ​​the (Industrial) Internet of Things ((I)IoT). Although honeypots are a very useful tool to complement cybersecurity strategies, implementing them for specific needs and target systems requires a lot of manual work by experts.

[0003] Approaches that enable easier deployment (especially configuration) of a suitable honeypot for a given target system are therefore desirable.

[0004] According to various embodiments, a method for creating a honeypot for a (given) target system is provided, comprising determining services provided and supported protocols by a target system to be imitated via a network interface by sending requests to the target system for a plurality of services (e.g. requests for a port scan such as service requests, synchronization packets, NULL packets, fin scan packets, etc. to which the target system may respond), determining a honeypot type (e.g. a honeypot architecture) and a configuration for the selected honeypot type, which, when configured with the selected configuration, can provide the determined services and support the determined protocols, and creating a honeypot of the determined honeypot type with the determined configuration.

[0005] The method described above enables the automatic creation of a honeypot with low interaction for a black-box target system, e.g. without requiring source code of the software running on the target system.

[0006] Automatic generation (including automatic configuration) is not limited to specific network services or protocols. The black-box approach, as described above, allows derivation without access to the source code or the internal structure of the target system. Only network access to the target system is required. This makes it possible to offer honeypot services to operators of target systems who do not want to disclose the inner workings of their (target) systems. The black-box approach ensures that honeypots can be derived without prior specialized knowledge of the honeypot structure and device specifics.

[0007] Since the creation of the honeypot is based on knowledge gained by observing (scanning) the target system from the outside (and, for example, without knowledge of the internal function or structure of the target system (unless it can be inferred from the results of the scanning)), the above approach can be regarded as a black-box creation of a honeypot.

[0008] Various examples of implementation are given below.

[0009] Embodiment 1 is a method for creating a honeypot (for a given target system) as described above.

[0010] Embodiment 2 is the method according to embodiment 1, wherein at least some of the requests are port scan packets.

[0011] Performing a port scan allows for effective identification of supported services and the protocols used for them.

[0012] Embodiment 3 is the method according to embodiment 1 or 2, wherein a secrecy criterion is checked for information about the target system and the honeypot is created in such a way that it does not contain information to be kept secret according to the secrecy criterion.

[0013] The honeypot creation facility can therefore filter information obtained (by scanning, ie sending queries) or from other sources) and create the honeypot based on the filtered information (ie without the filtered information).

[0014] Embodiment 4 is the method according to one of the embodiments 1 to 3, wherein, based on the determined services provided and supported protocols by the target system to be imitated, a Boolean expression is determined which the honeypot is to fulfill, and the honeypot type and the configuration are determined such that the Boolean expression is fulfilled.

[0015] This enables efficient and automatic selection (e.g., by appropriate parsing of the Boolean expression by a selection tool running on the honeypot creation facility, e.g., selecting a honeypot type from a honeypot library and determining a configuration for it) of the honeypot type and configuration.

[0016] Embodiment 5 is a data processing system with a honeypot generation device, which is configured to carry out the method according to one of the embodiments 1 to 4.

[0017] Embodiment 6 is a computer program including instructions that, when executed by a processor, cause the processor to perform a method according to any one of embodiments 1 to 4.

[0018] Embodiment 7 is a computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method according to any one of embodiments 1 to 4.

[0019] In the drawings, like reference characters generally refer to the same parts throughout the several views. The drawings are not necessarily to scale, emphasis instead generally being placed upon illustrating the principles of the invention. In the following description, various aspects are described with reference to the following drawings. Fig. 1 shows a computer network. Fig. 2 illustrates the creation of a honeypot according to one embodiment. Fig. 3 shows a flowchart illustrating a method for creating a honeypot for a target system according to one embodiment.

[0020] The following detailed description refers to the accompanying drawings, which, by way of illustration, show specific details and aspects of this disclosure in which the invention may be practiced. Other aspects may be utilized, and structural, logical, and electrical changes may be made without departing from the scope of the invention. The various aspects of this disclosure are not necessarily mutually exclusive, as some aspects of this disclosure may be combined with one or more other aspects of this disclosure to form new aspects.

[0021] Various examples are described in more detail below.

[0022] Fig. 1 shows a computer network 100. The computer network 100 includes a plurality of data processing devices 101-105 interconnected by communication links 106. The data processing devices 101-105 include, for example, server computers 101 and control devices 102, as well as user terminals 103, 104.

[0023] Server computers 101 provide various services, such as websites, banking portals, etc. A control unit 102 is, for example, a control device for a robotic device such as a control device in an autonomous vehicle. The server computers 101 and control units 102 therefore perform various tasks, and typically a server computer 101 or a control unit 102 can be accessed from a user terminal 103, 104. This is particularly the case when a server computer 101 offers a user a functionality, such as a banking portal. However, a control unit 102 can also enable external access (e.g., so that it can be configured). Depending on the task of a server computer 101 or control unit 102, they can store security-relevant data and perform security-relevant tasks. Accordingly, they must be protected against attackers.For example, an attacker using one of the user terminals 104 could, through a successful attack, obtain secret data (such as keys), manipulate accounts, or even manipulate a control device 102 in such a way that an accident occurs.

[0024] One security measure against such attacks is a so-called honeypot 106 (implemented by one of the data processing devices 105). It supposedly provides functionality and thus serves as bait to attract potential attackers. However, it is isolated from secret information or critical functionality so that attacks on it take place in a controlled environment and the risk of compromising the actual functionality is minimized. It thus makes it possible to gain knowledge about attacks on a target system (e.g., one of the server computers 101 or one of the control units 102)—and thus the threat landscape—to which the implementation of suitable measures on the target system can respond without these attacks endangering the target system.

[0025] Gaining insights into the threat landscape related to a specific device or product is a challenging task. Putting a real system into the hands of attackers to investigate the attack path can provide a wealth of information. However, sacrificing a real device is often not an option—such environments could be exploited for subsequent attacks or are expensive to maintain in large numbers. A honeypot is a computer program that imitates a target system (i.e., typically a "high-value" device) to attract attackers. Low-interaction honeypots only imitate network-related services and monitor connection or login attempts. Honeypots are used in enterprise IT and the Internet of Things (IoT), and the increasing number of connected devices in the automotive sector suggests a similar trend.While low-interaction honeypots are a useful tool to monitor (malicious) interest in a specific device, creating honeypots for different devices is laborious.

[0026] According to various embodiments, an approach is therefore provided that enables the automatic determination of a suitable honeypot (e.g., a suitable honeypot architecture and configuration therefor) that mimics the target system. This is achieved by a honeypot generation device scanning the target system from the outside, thus determining externally visible properties of the target system, in particular services offered via its network interface and supported protocols, and generating a honeypot accordingly. Thus, according to various embodiments, a low-interaction honeypot can be efficiently generated for a target system without manual implementation.

[0027] Fig. 2 illustrates the creation of a honeypot according to one embodiment.

[0028] The selection of a honeypot architecture and the determination of a configuration therefor are performed by a honeypot generation device (implementing a "honeypot agent" A) corresponding, for example, to one of the user terminals 104 (e.g., a computer with which a user (such as a system administrator) configures the honeypot 106 and instructs the data processing device 105 to provide the thus configured honeypot 106).

[0029] First, honeypot agent A scans the target system 201, in Fig. 2 with "VaT" (for "valuable target") from the outside (i.e., via the network interface of the target system 201, i.e., what is visible via the network interface). In doing so, it detects all services NFSx of the target system 201 facing the outside (i.e., the other data processing devices of the computer network 100), i.e., those offered, and creates a scan result SR. From this scan result, the honeypot agent A forms a Boolean expression BE that contains the requirements for the honeypot to be created (e.g., which services and / or protocols the honeypot should support because these were detected during the scan; i.e., the detected services are converted into a Boolean expression). The honeypot agent A selects a suitable honeypot 202 (i.e., a suitable honeypot architecture, i.e., a suitable honeypot "type," e.g., a specific version number) that satisfies the Boolean expression BE.For example, the honeypot will be selected based on the services and / or protocols it offers. Honeypot agent A also uses the scan result to derive a configuration file (conf) that configures the selected honeypot 202.

[0030] Honeypot 203 is then created (e.g., by appropriate instructions from the honeypot creation device to data processing device 105). According to its architecture (i.e., its type) 202 and its configuration, it offers the (network) services m_NFSx detected in the scan, which mimic the services running on (and offered by) target system 201.

[0031] Honeypot agent A can scan the target system using network and vulnerability scanners such as Nmap and OpenVas. Such scanners typically attempt to detect the specific version of a network protocol to search for known vulnerabilities. In this case, the information obtained can be used to select and configure the honeypot (including its services).

[0032] The selection of the honeypot (or multiple honeypots) is based, as explained above, on a Boolean expression that contains all the properties the honeypot should fulfill. For example, a Boolean expression for a honeypot capable of mimicking MQTT, OpenSSH version 7.1, and HTTP has the following form: MQTT AND (OpenSSH_V7.1 OR SSH_configurable) AND http.

[0033] A honeypot (i.e., the honeypot architecture or honeypot type) whose properties evaluate the expression to true is selected as a suitable honeypot.

[0034] Once honeypot agent A has selected a honeypot, it creates the configuration conf for the selected honeypot. The configuration contains all the details of the services to be impersonated (or the services meet these requirements). This includes, for example, the network port on which the service runs, the banners and headers that identify the service externally, and protocol specifics (e.g., permitted login attempts). The configuration can be created in any suitable text format, such as JSON, YAML, or XML. A possible configuration for HTTP is the following:

[0035] The honeypot agent determines all information in the configuration when scanning the target system 201. This allows the honeypot 203 (especially the services it imitates) to be configured so that the honeypot 203 exactly imitates the scanned target system.

[0036] In summary, according to various embodiments, a method is provided as described in Fig. 3 shown.

[0037] Fig. 3 shows a flowchart illustrating a method for creating a honeypot for a (given) target system according to one embodiment.

[0038] In 301, services provided by a target system to be imitated via a network interface and supported protocols are determined by sending requests to the target system for a variety of services (e.g., requests for a port scan such as service requests, synchronization packets, NULL packets, fin-scan packets, etc., to which the target system may respond).

[0039] In 302, a honeypot type (e.g., a honeypot architecture) and a configuration for the selected honeypot type are determined (e.g., such that the honeypot type), when configured with the selected configuration, can provide the determined services and support the determined protocols.

[0040] In 303, a honeypot of the determined honeypot type with the determined configuration is created (ie, by configuring the determined honeypot type with the determined configuration).

[0041] The procedure of Fig.3 may be performed by one or more computers having one or more data processing units. The term “data processing unit” may be understood as any type of entity that enables the processing of data or signals. The data or signals may, for example, be handled according to at least one (i.e., one or more than one) specific function performed by the data processing unit. A data processing unit may include or be formed from an analog circuit, a digital circuit, a logic circuit, a microprocessor, a microcontroller, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a programmable gate array (FPGA) integrated circuit, or any combination thereof.Any other way of implementing the respective functions described in more detail herein may also be understood as a data processing unit or logic circuit arrangement. One or more of the method steps described in detail herein may be performed (e.g., implemented) by a data processing unit through one or more specific functions performed by the data processing unit.

[0042] According to various embodiments, the method is therefore particularly computer-implemented.

Claims

[1] A method for creating a honeypot (106, 203) for a target system (201), comprising: Determining (301) services provided and supported protocols by a target system (201) to be imitated via a network interface by sending requests to the target system (201) for a plurality of services; Determining (302) a honeypot type (202) and a configuration for the selected honeypot type (202) that, when configured with the selected configuration, can provide the determined services and support the determined protocols; and Creating (303) a honeypot (106, 203) of the determined honeypot type (202) with the determined configuration. [2] The method of claim 1, wherein at least a portion of the requests are port scan packets. [3] Method according to claim 1 or 2, wherein a secrecy criterion is checked for information about the target system (201) and the honeypot (106, 203) is created in such a way that it does not contain information to be kept secret according to the secrecy criterion. [4] Method according to one of claims 1 to 3, wherein, based on the determined services provided and supported protocols by the target system (201) to be imitated, a Boolean expression is determined which the honeypot (106, 203) is to fulfill, and the honeypot type (202) and the configuration are determined such that the Boolean expression is fulfilled. [5] Data processing system with a honeypot generating device (104, 201) which is arranged to carry out the method according to one of claims 1 to 4. [6] A computer program comprising instructions which, when executed by a processor, cause the processor to perform a method according to any one of claims 1 to 4. [7] A computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform a method according to any one of claims 1 to 4.

Images