A Virtual Honeypot Framework

By Niels Provos. 2004

816 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Privacy & Security

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, methodology): “Lastly, they suggest the use of disinformation with for instance honeypots [80] and randomization of the ML model behavior.”
SoK: Security and Privacy in Machine Learning (2018, background): “The authors also mention an attack detection strategy based on isolating a special holdout set to detect poisoning attempts. Lastly, they suggest the use of disinformation with for instance honeypots [80] and randomization of the ML model behavior. Defending against inference-time attacks: The difﬁc”
Modeling Botnet Propagation Using Time Zones (2006, methodology): “As noted above, many honeypot systems can observe all outgoing scans created by a trapped worm [ Pro03 ].”
The Nepenthes Platform: An Efficient Approach to Collect Malware (2006, background): “However, their expressiveness is also limited and only with further extensions it is possible to also learn more about spreading malware. honeyd [14] is a prominent example of a low-interaction honeypot.”
Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities (2006, methodology): “Existing honeypot techniques can be categorized using two other criteria: (1) physical honeypots [KGO+05] with dedicated physical machines versus virtual honeypots built on Virtual Machines [VMW,UML]; (2) lowinteraction honeypots [ P04 ], which only simulate network protocol stacks of different oper”
Secure or insure?: a game-theoretic analysis of information security games (2008, background): “, early warnings about new attack and exploitation trends [30].”
These aren't the droids you're looking for: retrofitting android to protect data from imperious applications (2011, background): “Honeypots and Honeynets [17, 19, 21] have popularized the use of shadow resources to run malware while studying its behavior and limiting its potential to do damage.”
An Advanced Hybrid Peer-to-Peer Botnet (2007, background): “Furthermore, a sophisticated botmaster could even program bot code to mimic the protocol format of the service port as what “honeyd” [23] does.”
A Survey of Botnet and Botnet Detection (2009, background): “For instance, solutions in [4, 18] have been initial honeynet-based solutions.”
Remote physical device fingerprinting (2005, background): “The linear programming solution outputs the equation of a line αx + β that upper-bounds the set of points OT .”
A multifaceted approach to understanding the botnet phenomenon (2006, methodology): “Our system design and implementation draw on experience learned from earlier work [1, 2, 10, 19, 20, 23], but include several additions that are unique to our goals.”
Optimal Network Security Hardening Using Attack Graph Games (2015, background): “Legitimate users do not interact with honeypots; hence, honeypots act as decoys and distract attackers from the real hosts, send intrusion detection alarms to the administrator, and/or gather detailed information the attacker’s activity [26, 10].”
Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation (2006, background): “Even though Argos is its main input for this project, we have also connected SweetBait to lowinteraction honeypots based on honeyd [33] and honeycomb [27].”
The monitoring and early detection of Internet worms (2005, neutral): “This work was supported in part by the Army Research Of.ce under Contract DAAD19-01-1-0610, the Defense Advanced Research Projects Agency under Contract DOD F30602-00-0554, the National Science Foundation under Grants EIA-0080119, ANI9980552, and ANI-0208116, and the Air Force Research…”
Behind the Scenes of Online Attacks: an Analysis of Exploitation Behaviors on the Web (2013, background): “The result is that almost all the web infections panorama has been studied in detail: how attackers scan the web or use google dorks to find vulnerable applications, how they run automated attacks, and how they deliver malicious content to the final users.”
Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks (2005, background): “It is comparable to a lowinteraction honeypot like honeyd [16].”
Internet attack knowledge discovery via clusters and cliques of attack traces (2006, methodology): “These operating systems are emulated as services using the low-interaction honeypot software honeyd [11].”