Shark: Spy Honeypot with Advanced Redirection Kit

Botnets represent a big threat for the Quality of Internet Services, as they are the source of many malicious activ-ities (DoS attacks, Spam, secret violation, etc). Our work focuses on trying to detect, observe and disable botnets by infiltrating them. For this purpose, this study focuses on discovering the behavior of malware which drives the bots. The paper presents the design of an experimental platform which takes advantage of the honeypot technology for downloading malware, and especially, serves as an infrastructure allowing the observation and the analysis of the collected malware behaviors, which is the contribution of this paper. For this purpose, we are designing SHARK, a Spy Honeypot with Advanced Redirection Kit. The redi-rection kit aims at coping with some liability constraints which forbid one to send out malicious traffic which could pollute or corrupt any other machines. This paper presents first results on the gathered malware observation and analysis, and some conclusions on botnet behaviors, thus demonstrating the interest and pertinence of this platform