Collapsar: a VM-based architecture for network attack detention center

摘要: The honeypot has emerged as an effective tool to provide insights into new attacks and current exploitation trends. Though effective, a single or multiple independently operated honeypots only limited local view of network attacks. Deploying managing large number coordinating in different domains will not broader more diverse view, but also create potentials global status inference, early anomaly detection, attack correlation scale. However, coordinated deployment operation require close consistent collaboration across participating domains, order mitigate potential security risks associated with each the non-uniform level expertise domains. It is challenging, yet desirable, two conflicting features decentralized presence uniform management operation. To address these challenges, this paper presents Collapsar, virtual-machine-based architecture for detention. A Collapsar center hosts manages high-interaction virtual dedicated network. These appear, intruders, typical systems their respective production networks. Decentralized logical provides wide attacks, while centralized enables administration convenient event correlation, eliminating need experts domain. We present design, implementation, evaluation testbed. Our experiments several real-world incidences demonstrate effectiveness practicality Collapsar.