Cloud Honeypot Log Normalization for Malicious Code Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in efficiently collecting and analyzing malicious code data using honeypot systems, particularly when deployed across multiple cloud servers in different IP bands, due to the diversity of log information types and formats.
Innovation Solution
An electronic apparatus and method that normalizes and parses log information from various honeypot platforms across multiple cloud servers, allowing for the collection and identification of malicious code by item, and stores the indexed data for efficient utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If honeypot systems are deployed across multiple cloud servers in different IP bands, then the quantity of malicious code data collected is improved, but the complexity of log information management worsens
Solution Approach 1:
The system segments log information into multiple dimensions including IP band, honeypot platform type, log type, and item categories. Each log entry is parsed and tagged with specific attributes (e.g., attack type, service name, port) to enable organized management across distributed cloud servers.
Solution Approach 2:
The electronic apparatus serves as a central intermediary that collects logs from multiple cloud servers, normalizes diverse log formats into a unified structure, and aggregates malicious code information. This mediator approach simplifies management by centralizing the complexity of handling heterogeneous logs from different IP bands and platforms.
2Adaptability or versatility
If diverse honeypot platforms are used across cloud servers, then the versatility of malicious code detection is improved, but the difficulty of normalizing log information worsens
Solution Approach 1:
The electronic apparatus implements a universal log normalization framework that handles multiple honeypot platform types (e.g., HoneyPot, T-Pot, Cowrie) through a single system. The normalization process extracts common elements (IP addresses, ports, services, attack types) from different platform-specific log formats and converts them into a unified structure, enabling versatile detection across platforms without requiring separate processing for each.
3Loss of information
If log information is collected from multiple cloud servers, then the completeness of malicious code information is improved, but the time required for data processing worsens
Solution Approach 1:
The system performs preliminary parsing and categorization of log information as it is collected from cloud servers. Logs are pre-processed into standardized formats with extracted key fields (attack type, service, port, IP) before aggregation, reducing the processing burden during final analysis and enabling faster retrieval of malicious code information.
Data Source
AI summary
Disclosed is an electronic apparatus for implementing a honeypot control system. The electronic apparatus includes a communication interface, a memory configured to store execution information including information on a virtual machine built on a cloud server, information on a running service, and information on an open port, and a processor configured to functionally control the communication interface and the memory, wherein the processor is configured to transmit execution information obtained based on information stored in the memory to each of a plurality of cloud servers in different Internet Protocol (IP) bands through the communication interface, when log information is received from each of the plurality of cloud servers that have received the execution information through the communication interface, normalize the received log information, and obtain malicious code information using the normalized log information.