Honeyd - A OS Fingerprinting Artifice

This research looks at the efficiency of the honeyd honeypot system to reliably deceive intruders. Honeypots are being used as frontline network intelligence and forensic analysis tools. A honeypots ability to reliably deceive intruders is a key factor in gathering reliable and forensically sound data. Honeyd’s primary deceptive mechanism is the use of the NMAP fingerprint database to provide bogus OS fingerprints to would be intruders. Tests conducted by the author on honeyd's ability to provide bogus fingerprints sees 78% of 704 signatures invalidated under heavy probing. However, the tests have left 152 viable signatures for producing hardened honeypot designs. Keywords honeypot, deception, honeyd, NMAP, fingerprinting, forensics, network forensics

• Type: Conference
• Year: 2003
• Where: AUSFORENSICS
• Authors: Craig Valli
• Keywords: AUSFORENSICS 2003, Bogus Os Fingerprints, Forensic Engineering, Honeyd Honeypot, Honeyd's Ability