D T S S U C Sd d uc c ui udc

To track hackers’ activities, a system or a networked environment is needed where at each place every activity is gathered, so that it can be analysed either in real time or offline. honeynets have enormous capabilities to gather malicious data, control d

According to the Honeynet mroject and Research Alliance, a honeynet is a tool that can be used to learn about targets, and methods and tools used by intruders to attack a system. It has a network of systems that are designed to be compromised.

Conceptually, honeynets are very simple networks. These contain one or more honeypots. Since honeypots are not production systems, the honeynet itself has neither production activity nor authorised services. As a result, any interaction with a honeynet implies malicious or unauthorised activity. Any connection inbound to the honeynet is most likely a probe, scan or attack. Any unauthorised outbound connection from honeynet implies that someone has compromised the system and initiated outbound activity.

A honeynet is an architecture. This architecture creates a highly controlled network, which can control and monitor all the activity that happens within it (Fig. 1). The system administrator places target systems, or honeypots, within the architecture. In many ways, a honeynet is like a fishbowl. It is an environment where anyone can watch everything happening inside it.

Honeynets are used to build antivirus signatures, spam signatures and filters, identify compromised systems, assist law-enforcements authorities in tracking criminals, hunt and shutdown botnets, collect and analyse malware, and detect zero-day attacks.

To successfully deploy a honeynet, it is necessary to correctly deploy the honeynet architecture. The key to the honeynet architecture is a honeywall. This is a gateway device that separates honeypots from rest of the world. Any traffic going to or from a honeypot must go through the honeywall. den-III honeynets implement a new data model independent of the data source—according to the paper ‘ Towards A Third deneration Data Capture Architecture for Honeynets’ by Edward Balas and Camilo siecco presented at mroceedings of the Sixth IEEE Information Assurance Workshop in June 2005.

Tracking hackers’ activities using honeynets

To monitor and track malicious activities, a system or networked environment is needed where at each place from the network to the host system every activ-