A security pattern for honeypots
Eduardo B. Fernandez, Elias Bou-Harb, and Virginia Romero
Dept. of Computer and Electr. Eng. and Comp. Science
Florida Atlantic University
Boca Raton, FL 33431, USA

IntentAttract attacks generated by intruders to understand and capture their intentions, mechanisms,
strategies and potential for success in order to prepare better to defend against these attacks.
Attackers are lured by mimicking internal, typically sensitive services.
Context
Systems and corporate networks connected to the Internet.
.
ProblemOn one hand, corporate networks and their corresponding services are constantly being attacked.
When attackers bypass the external defense mechanisms, they can easily target any internalservice. There is a critical need to defend against such attempts to protect the real operational
services and to alert against an infiltrated attacker (Even 2017).
On the other hand, it is often hard to derive the modus operandi (attack signatures) for novel andcomplex attacks. This is especially factual when operating in less explored or constrained
environments such as power grids or manufacturing plants. We need a way to detect those attacks
in real time.
Forces• Extensibility and Flexibility—ability to promptly add or modify certain features and/orprotocols to reflect new mimicked services, which help lure more attackers or attract
attackers infiltrating different realms.
• Usability—the software should be easy to install, configure, manage and its reporting
should be comprehensive and actionable.
• Legitimacy as network assets/resource—the software should closely mimic the services
desired to be protected; from an attacker perspective, the honeypot should appear as a
typical legitimate operational service.
• Mingling Factor—the detection device should communicate with other assets on thenetwork to contribute to its deception characteristics.
• Exploitation resilience—the detection device should lure attackers but prevent its
components from complete system exploitation.
• Alerting and Logging—any connection attempt must produce an alert and should be logged.
• Reporting: a honeypot must provide clear and actionable reports of the detected attacks in
an appropriate, non-proprietary format.

Solution
Place an easy and appealing target, a honeypot, to attract attacks and lure intruders, so we canassess (i.e., infer, characterize, mitigate, and attribute) them and prepare ways to halt them.
A honeypot, when configured with services operating in such realms, could be used to capture
significant attack strategies, intentions and mechanisms to aid in deriving effective attack
signatures that can be used for detection, mitigation, and attribution, as well as to indicate possible
defenses.
Structure
Figure 1 shows the class diagram of this pattern. The Honeypot includes several Service Proxies
that represent real Services provided by the local Server. When the Attacker attempts to access anyof these proxies the Attack Detector captures its Signature which is placed in the Attack Signature
Catalog. The Attack Detector activates an Alert for the system administrator and keeps a Log ofeach event received during the attack. Reports are generated at periodic intervals from the Log.

Attacker

attackService
1*

HoneypotrequestService
1*

*

*

ServiceProxy*Serversimulates
11

ServiceredirectAttacks

1AttackDetector*Alert1Log
11Report

1AttackSignature
Catalog** Signature

Figure 1. Class diagram of the Honeypot pattern
Dynamics
Figure 2 shows a use case for detecting an attack. When the Attacker tries to access a service
through its Proxy, the Attack detector captures its signature, registers it in the Log, and creates anAlert. This signature can be used later to recognize another instance of the attack.

Implementation
You can configure and deploy honeypots internally, as an additional layer of protection.
Investigate how and where past attacks have succeeded. Generate threat models from past andnovel attacks and try to characterize future possible attacks. Determine where you have gaps inyour current detection methodologies and deploy tailored honeypots to meditate those gaps (Even2017, Grimes 2016).
Build attack signatures that aim at reducing both, false positives and false negatives. This isespecially important when deployed in non-traditional environments such as cyber-physicalsystems (i.e., power stations, manufacturing plans, cargo terminals, etc.).
Honey Pots are typically deployed inside a firewall or inside the DMZ . They should appear to be
standard services to avoid the attacker’s suspicions. The idea is that the attacker returns so we cancollect more information about his probing (Even 2017).

: Attacker: Service
Proxyrequest(Service): AttackDetector

request(Service): Attack
Signaturesdetect(Signature)log(Signature)create: Log: AlertFigure 2. Sequence diagram for use case Detect Attack
Known uses
• KFSensor is pre-configured to monitor all TCP and UDP ports, along with ICMP
[KFSensor]. It is also configured with the emulation of common services. KFSensor isconsidered to be one of the best in [Grimes 2010].
•Honeyd is an open source honeypot [Provos].

•OpenCanary [Canary] is another open source honeypot, which exceeds Honeyd by its easeof use and configuration, and actionable reporting features.

•Conpot [Conpot] is an open source honeypot specifically tailored towards industrial controlsystems.

Consequences• Extensibility and Flexibility—a honeypot will effectively be able to mimic diverse andtailored services to increase the detection rate.
• Usability—a well-thought interface can achieve usability.
• Legitimacy as network assets/resource—the honeypot will increase its detection rate byoptimizing its deception characteristics.
• Mingling Factor—the honeypot will lure more attackers, which also increases its detection
and protection rate.
• Exploitation resilience—the honeypot will be able to handle more attackers, thus increasing
its protection rate.
• Alerting and Logging—the honeypot will be able to effectively alert concerned parties
about an ongoing attack for effective mitigation and use logged data for future planning.
• Reporting: the honeypot will be able to generate cyber threat intelligence that caneffectively be used in long-term analysis and actionable thwarting of attacks.
Related patterns• Intrusion Detection Systems (IDS) [Fernandez 2013]. IDSs detect and report attacks in realtime by employing various inference engines, which could rely on signatures, behavioral
analysis or a combination of those. A honeypot, in contrast, adopts the concept of detection
by deception, which adds a complementary layer to the defense strategy.
• The Log is a special case of the Security Logger/Auditor [Fernandez 2013]. A Logger keeps
track of user’s actions in order to determine who did what and when. It also provides
controlled access to its records for Audit purposes.
• The Service Proxy is a variety of the Proxy pattern of [Gamma et al. 1994]. A Proxyrepresents an object and controls access to it.
Acknowledgements
We thank our shepherd, Shinpei Hayashi, for his valuable comments that significantly improved
our paper.

References
Canary. Canary: Bring back the Honeypots.
http://thinkst.com/stuff/bh2015/thinkst_BH_2015_notes.pdf
Conpot. Conpot: ICS honeypot. http://thinkst.com/stuff/bh2015/thinkst_BH_2015_notes.pdf
L.R.Even, “Honey Pot systems explained”, https://www.sans.org/security-resources/idfaq/whatis-a-honeypot/1/9
E.B.Fernandez, “Security patterns in practice: Building secure architectures using softwarepatterns”, Wiley Series on Software Design Patterns, 2013.
E. Gamma, R. Helm,R. Johnson, and J. Vlissides, Design patterns –Elements ofreusable object-oriented software, Addison-Wesley 1994.
R.A.Grimes, “Intrusion detection honeypots simplify network security”, InfoWorld, Nov. 17,2010,
http://www.infoworld.com/article/2624430/intrusion-detection/intrusion-detectionhoneypots-simplify-network-security.html (last accessed Jan. 03, 2017)
R.A.Grimes, “Spread honeypots over your defense plan”, InfoWorld, March 29, 2016
http://www.infoworld.com/search?query=honeypots&contentType=article%2Cresource(last accessed Jan. 03, 2017)
KFSensor. KFSensor, Advanced Windows Honeypot System, http://www.keyfocus.net/kfsensor/
Niels Provos, “Honeyd: A Virtual Honeypot Daemon” (Extended Abstract),
http://metro.citi.umich.edu/u/provos/papers/honeyd-eabstract.pdf