Worm Detection Using Honeypots

摘要: This thesis describes a project that utilizes honeypots to detect worms. A detailed description of existing worm detection techniques using is given, as well study propagation models. Simulations some these models are also conducted. Although the results simulations coincide with collected data from actual outbreak network worm, they conclude it difficult produce realistic prior outbreak. mechanism called HoneyComb incorporated in honeypot setup installed at NTNU, and experiments conducted evaluate its effectiveness reliability. The generated large amount false positives experiments, possibly due an error discovered implementation algorithm. An architecture for unknown worms proposed. based on combination two recently published systems extension referred Known-Attack (KA) filter. By this filter, believed traffic needed be processed by sensors will considerably reduced.