Projektiranje sigurnosti informacijsko-komunikacijskog sustava primjenom mehanizma Honeypot

master's thesis

• Title (english): Design of the Information and Communication System Security Using the Honeypot Mechanism
• Author: Tomislav Nagy
• Mentor: Dragan Peraković (mentor)
• Committee member: Marko Periša (predsjednik povjerenstva)
• Committee member: Ivan Grgurević (član povjerenstva)
• Committee member: Štefica Mrvelj (član povjerenstva)
• Granter: University of Zagreb; Faculty of Transport and Traffic Sciences; (Division of Transport); (Department of Information and Communications Traffic); Zagreb
• Defense date and country: 2016-09-27, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Traffic and Transport Technology; Postal and Telecommunications Traffic

Abstract

Honeypot sustav je sigurnosni resurs čija vrijednost leži u mogućnosti da bude ispitan,
napadnut ili kompromitiran. Administrator sustava je u mogućnosti prikupiti informacije o
napadaču, vektorima napada i alatima koje napadač koristi kako bi zadobio pristup napadnutom
sustavu. U svrhu ovog istraživanja korišteni su Valhala i Bifrozt alati. Valhala je nisko/srednje
interaktivni Honeypot sustav što znači da napadač u interakciji sa sustavom može koristiti samo
ograničen popis naredbi. Valhala Honeypot sustav uspješan je u detekciji raznih automatiziranih
skripti, no vješti napadači su u mogućnosti vrlo brzo otkriti prisutnost takvog sustava. Bifrozt je
visoko interaktivni Honeypot sustav. Napadaču je dana mogućnost koristiti cijeli sustav i svaka je
od usluga istovjetna produkcijskoj usluzi. Administrator je u mogućnosti prikupiti veliku količinu
informacija, a da pri tome napadač toga nije ni svjestan. S obzirom na to da je cilj istraživanja bio
otkriti mogu li Honeypot sustavi uspješno zabilježiti upad u sustav, otkriti informacije o napadaču,
vektorima napada i alatima koje napadači koriste, oba su Honeypot sustava zadovoljila.

Abstract (english)

Honeypot system is a security resource whose value lies in the possibility of being tested,
attacked or compromised. The system administrator is able to collect information about the attacker,
attack vectors and tools that a hacker uses to gain access to the attacked system. For the purposes
of this study were used Valhalla and Bifrozt tools. Valhalla is low / medium interactive Honeypot
system which means that an attacker can only use a limited list of commands to interact with the
system. Valhala Honeypot system was successful in detecting a variety of automated scripts, but
skilled attackers are still able to quickly detect the presence of such a system. Bifrozt is highly
interactive Honeypot system. The possibility that is given to the attacker is to interact with the
whole system and each of the services is identical to the production system. The administrator is
able to collect a large amount of information, while at the same time attacker was not even aware
of it. Considering that the aim of the research was to discover whether Honeypot systems can
successfully record an intrusion in the system, reveal information about the attacker, attack vectors
and tools used by the attackers, both Honeypot systems satisfied requirements.

• Keywords: Botnet mreže; Honeypot; Honeynet; Valhala Honeypot; Bifrozt Honeypot
• Keywords (english): Botnet networks; Honeypot; Honeynet; Valhala Honeypot; Bifrozt Honeypot
• Language: croatian
• URN:NBN: urn:nbn:hr:119:815348
• Study programme: Title: Traffic and Transport; specializations in: Road Traffic and Transport, Railway Traffic and Transport, Water Traffic and Transport, Air Traffic and Transport, Postal Traffic, Information and Communication Traffic, Urban Traffic and Transport; Course: Information and Communication Traffic; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka prometa (magistar/magistra inženjer/inženjerka prometa)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2016-10-05 12:32:16