Design of the Information and Communication System Security Using the Honeypot Mechanism

Honeypot sustav je sigurnosni resurs čija vrijednost leži u mogućnosti da bude ispitan, napadnut ili kompromitiran. Administrator sustava je u mogućnosti prikupiti informacije o napadaču, vektorima napada i alatima koje napadač koristi kako bi zadobio pristup napadnutom sustavu. U svrhu ovog istraživanja korišteni su Valhala i Bifrozt alati. Valhala je nisko/srednje interaktivni Honeypot sustav što znači da napadač u interakciji sa sustavom može koristiti samo ograničen popis naredbi. Valhala Honeypot sustav uspješan je u detekciji raznih automatiziranih skripti, no vješti napadači su u mogućnosti vrlo brzo otkriti prisutnost takvog sustava. Bifrozt je visoko interaktivni Honeypot sustav. Napadaču je dana mogućnost koristiti cijeli sustav i svaka je od usluga istovjetna produkcijskoj usluzi. Administrator je u mogućnosti prikupiti veliku količinu informacija, a da pri tome napadač toga nije ni svjestan. S obzirom na to da je cilj istraživanja bio otkriti mogu li Honeypot sustavi uspješno zabilježiti upad u sustav, otkriti informacije o napadaču, vektorima napada i alatima koje napadači koriste, oba su Honeypot sustava zadovoljila.Honeypot system is a security resource whose value lies in the possibility of being tested, attacked or compromised. The system administrator is able to collect information about the attacker, attack vectors and tools that a hacker uses to gain access to the attacked system. For the purposes of this study were used Valhalla and Bifrozt tools. Valhalla is low / medium interactive Honeypot system which means that an attacker can only use a limited list of commands to interact with the system. Valhala Honeypot system was successful in detecting a variety of automated scripts, but skilled attackers are still able to quickly detect the presence of such a system. Bifrozt is highly interactive Honeypot system. The possibility that is given to the attacker is to interact with the whole system and each of the services is identical to the production system. The administrator is able to collect a large amount of information, while at the same time attacker was not even aware of it. Considering that the aim of the research was to discover whether Honeypot systems can successfully record an intrusion in the system, reveal information about the attacker, attack vectors and tools used by the attackers, both Honeypot systems satisfied requirements