SweetBait: Zero-hour worm detection and containment using low- and high-interaction honeypots

摘要: As next-generation computer worms may spread within minutes to millions of hosts, protection via human intervention is no longer an option. We discuss the implementation SweetBait, automated system that employs low- and high-interaction honeypots recognise capture suspicious traffic. After discarding whitelisted patterns, it automatically generates worm signatures. To provide a low response time, signatures be immediately distributed network intrusion detection prevention systems. At same time are continuously refined for increased accuracy lower false identification rates. By monitoring signature activity predicting ascending or descending trends in virulence, we able sort order urgency. result, set monitored filtered managed such way new very active always included set, while size bounded. SweetBait deployed on medium sized academic networks across world react zero-day minutes. Furthermore, demonstrate how globally sharing can help immunise parts Internet.