Detecting targeted attacks using shadow honeypots

摘要: We present Shadow Honeypots, a novel hybrid architecture that combines the best features of honeypots and anomaly detection. At high level, we use variety detectors to monitor all traffic protected network/service. Traffic is considered anomalous processed by "shadow honeypot" determine accuracy prediction. The shadow an instance software shares internal state with regular ("production") application, instrumented detect potential attacks. Attacks against are caught, any incurred changes discarded. Legitimate was misclassified will be validated handled correctly system transparently end user. outcome processing request used filter future attack instances could update detector. Our allows designers fine-tune systems for performance, since false positives filtered shadow. Contrary honeypots, our can both server client applications. demonstrate feasibility approach in proof-of-concept implementation Honeypot Apache web Mozilla Firefox browser. show despite considerable overhead instrumentation honeypot (up 20% Apache), overall impact on diminished ability minimize rate false-positives.