Rule Generator for IPS by Using Honeypot to Fight Polymorphic Worm

被引：0

作者：

Silalahi, Daniel ^{[1
]}

Asnar, Yudistira ^{[1
]}

Perdana, Riza Satria ^{[1
]}

机构：

[1] Inst Teknol Bandung, Sch Elect Engn & Informat, Bandung, Indonesia

来源：

PROCEEDINGS OF 2017 INTERNATIONAL CONFERENCE ON DATA AND SOFTWARE ENGINEERING (ICODSE) | 2017年

关键词：

Rule Generator; IPS; signature based; signature generator; honeypot; Snort; Dionaea; Polygraph;

D O I：

暂无

中图分类号：

TP31 [计算机软件];

学科分类号：

081202 ; 0835 ;

摘要：

Nowadays, most network is already protected by Intrusion Prevention System (IPS). But most of the IPS is using signature based detection techniques, whereas signature update tends to be difficult and time consuming because it requires expert knowledge in the making. Therefore, IPS signature based has a weakness in detecting latest attack. This paper present a signature-generating technique by using signature generator and honeypot. The signature generator used in this paper is Polygraph because has an advantage on detecting polymorphic worm. The honeypot used is Dionaea because the log can be converted into the forms required by Polygraph. This paper will discuss what steps are needed in transforming attack data from honeypot into a rule that can be used by IPS Snort.

引用

页数：5