Honeynet based distributed adaptive network forensics and active real time investigation

ABSTRACT

Network forensics and honeynet systems have the same features of collecting information about the computer misuses. Honeynet system can lure attackers and gain information about new types of intrusions. Network forensics system can analysis and reconstruct the attack behaviors. These two systems integrating together can help to build an active self-learning and response system to profile the intrusion behavior features and investigate the attack original source. In this paper, we present a design of honeynet based active network intrusion response system. The features of our system are distributed adaptive network forensics and active real time network investigation.

REFERENCES

• 1: Know Your Enemy: Gen II Honeynets, November 2003. http://project.honeynet.org/papers/gen2/
• 2: Gary Palmer, A Road Map for Digital Forensic Research, Technical Report DTRT0010-01, DFRWS, November 2001. Report from the First Digital Forensic Research Workshop (DFRWS)

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.4 Distributed Systems

Additional Classification:
  C. Computer Systems Organization
  C.3 SPECIAL-PURPOSE AND APPLICATION-BASED SYSTEMS

General Terms:
Design, Management, Security

Keywords:
computer forensics, digital forensics, honeynet, network, network forensics, network security