Tytuł:

Graph-based Forensic Analysis of Web Honeypot, Journal of Telecommunications and Information Technology, 2016, nr 2

Autor:

Studiawan, Hudan ; Pratomo, Adi ; Djanali, Supeno

Temat i słowa kluczowe:

access log ; graph agglomerative clustering ; attack type ; visualization of large graphs

Opis:

Honeypot still plays an important role in network security, especially in analyzing attack type and defining attacker patterns. Previous research has mainly focused on detecting attack pattern while categorization of type has not yet been-comprehensively discussed. Nowadays, the web application is the most common and popular way for users to gather information, but it also invites attackers to assault the system. Therefore, deployment of a web honeypot is important and its forensic analysis is urgently required. In this paper, authors propose attack type analysis from web honeypot log for forensic purposes. Every log is represented as a vertex in a graph. Then a custom agglomerative clustering to categorize attack type based on PHP-IDS rules is deployed. A visualization of large graphs is also provided since the actual logs contain tens of thousands of rows of records. The experimental results show that the proposed model can help forensic investigators examine a web honeypot log more precisely.

Wydawca:

National Institute of Telecommunications

Data wydania:

2016, nr 2

Typ zasobu:

artykuł

Format:

application/pdf

Identyfikator zasobu:

ISSN 1509-4553, on-line: ISSN 1899-8852

Źródło:

Journal of Telecommunications and Information Technology

Język:

ang

Prawa:

Biblioteka Naukowa Instytutu Łączności