• DocumentCode
    1127970
  • Title

    Honeypot forensics, part II: analyzing the compromised host

  • Author

    Raynal, Frédéric ; Berthier, Yann ; Biondi, Philippe ; Kaminsky, Danielle

  • Volume
    2
  • Issue
    5
  • fYear
    2004
  • Firstpage
    77
  • Lastpage
    80
  • Abstract
    Although flows are an effective method for monitoring honeypots in real time, they are not sufficient if we want to learn more about the intruder. To accomplish this goal, we must investigate the compromised host itself. In this article, we show how to build two timelines of events: one from network clues and the other from what the host tells us. We can then merge these timelines and answer additional questions.
  • Keywords
    computer network management; security of data; telecommunication security; compromised host; event timelines; honeypot forensics; intruder; network clues; Computer security; Computerized monitoring; Cryptography; Debugging; Forensics; Geophysical measurement techniques; Ground penetrating radar; Postal services; Privacy; Reverse engineering; honeynets; honeypots; network analysis;
  • fLanguage
    English
  • Journal_Title
    Security & Privacy, IEEE
  • Publisher
    ieee
  • ISSN
    1540-7993
  • Type

    jour

  • DOI
    10.1109/MSP.2004.70
  • Filename
    1341417
    • Link To Document
    https://search.isc.ac/dl/search/defaultta.aspx?DTC=49&DC=1127970