Automating the Analysis of Honeypot Data

摘要

We describe the on-going work towards further automating the analysis of data generated by a large honeynet architecture called Leurre.com and SGNET. The underlying motivation is helping us to integrate the use of honeypot data into daily network security monitoring. We propose a system based on two automated steps: ⅰ) the detection of relevant attack events within a large honeynet traffic data set, and ⅱ) the extraction of highly similar events based on temporal correlation.