Automatic handling of protocol dependencies and reaction to 0-day attacks with ScriptGen based honeypots

Corrado Leita, Marc Dacier, Frederic Massicotte

Research output: Chapter in Book/Report/Conference proceedingConference contribution

34 Scopus citations


Spitzner proposed to classify honeypots into low, medium and high interaction ones. Several instances of low interaction exist, such as honeyd, as well as high interaction, such as GenII. Medium interaction systems have recently received increased attention. ScriptGen and RolePlayer, for instance, are as talkative as a high interaction system while limiting the associated risks. In this paper, we do build upon the work we have proposed on ScriptGen to automatically create honeyd scripts able to interact with attack tools without relying on any arpriori knowledge of the protocols involved. The main contributions of this paper are threefold. First, we propose a solution to detect and handle so-called intrarprotocol dependencies. Second, we do the same for inter-protocols dependencies. Last but not least, we show how, by modifying our initial refinement analysis, we can, on the fly, generate new scripts as new attacks, i.e. 0-day, show up. As few as 50 samples of attacks, i.e. less than one per platform we have currently deployed in the world, is enough to produce a script that can then automatically enrich all these platforms. © Springer-Verlag Berlin Heidelberg 2006.
Original languageEnglish (US)
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
PublisherSpringer Verlag
Number of pages21
ISBN (Print)354039723X
StatePublished - Jan 1 2006
Externally publishedYes

Bibliographical note

Generated from Scopus record by KAUST IRTS on 2022-09-12


Dive into the research topics of 'Automatic handling of protocol dependencies and reaction to 0-day attacks with ScriptGen based honeypots'. Together they form a unique fingerprint.

Cite this