Using VMM-based sensors to monitor honeypots

14 years 1 months ago
Using VMM-based sensors to monitor honeypots
Virtual Machine Monitors (VMMs) are a common tool for implementing honeypots. In this paper we examine the implementation of a VMM-based intrusion detection and monitoring system for collecting information about attacks on honeypots. We document and evaluate three designs we have implemented on two opensource virtualization platforms: User-Mode Linux and Xen. Our results show that our designs give the monitor good visibility into the system and thus, a small number of monitoring sensors can detect a large number of intrusions. In a three month period, we were able to detect five different attacks, as well as collect and try 46 more exploits on our honeypots. All attacks were detected with only two monitoring sensors. We found that the performance overhead for monitoring such intrusions is independent of which events are being monitored, but depends entirely on the number of monitoring events and the underlying monitoring implementation. The performance overhead can be significantly ...
Kurniadi Asrigo, Lionel Litty, David Lie
Added 14 Jun 2010
Updated 14 Jun 2010
Type Conference
Year 2006
Where VEE
Authors Kurniadi Asrigo, Lionel Litty, David Lie
Comments (0)