Loading...

Design and Implementaion of a Web Application Honeypot

Ali Akbarian, Amir Hossein | 2013

871 Viewed
  1. Type of Document: M.Sc. Thesis
  2. Language: Farsi
  3. Document No: 44019 (19)
  4. University: Sharif University of Technology
  5. Department: Computer Engineering
  6. Advisor(s): Kharrazi, Mehdi
  7. Abstract:
  8. With the rapid growth of Internet popularity, web applications are growing in usage and complexity, and therefore, are attractive targets for attackers. Increasing number of services and amount of information stored in the Internet, stimulates attackers to focus on these kind of applications. On the other hand, security specialists are deploying different solutions to mitigate such threats. One of these solutions are Honeypot systems. In contrast with other security solutions, honeypots are not designed to defend against attackers directly. Honeypots, rather, are planned to gather data about what attackers do. This information can help security administrators to learn and understand attackers behavior, their attack vectors and their goals. Also, honeypots will waste attacker time trying intrude the trap. In network security, Honeypots are popular and widely used. In the Web, however, honeypots are not so idespread, because introduced solutions are not able meet special requirements that a web application honeypot needs to answer in the Web. In this research, we have tried to look in to those requirements and propose a honeypot system which satisfies them. In the proposed solution, we get help from a real and functioning web application to attract attackers and keep them busy in the trap. We implement a simple honeypot based on our design as a proof of concept. We have evaluated the system by deploying it in front of a security competition portal, attracting attackers to take down the portal and fall in the trap. Obtained results showed that this honeypot can help security administrators in finding new vulnerabilities, as well as other useful information like attractive parts of application and their popular ways of attacking
  9. Keywords:
  10. Honeypot ; Application Security ; Application Vulnerability ; Forensics ; Vulnerability Scanning ; Intrusion Detection System ; Web Application

 Digital Object List

 Bookmark

  • 1 مقدمه
    • 1‏.‏1 ساختار پایان‌نامه
    • 1‏.‏2 پارسی نویسی
  • 2 پنداره‌های پایه
    • 2‏.‏1 تله‌عسل
      • 2‏.‏1‏.‏1 انگیزه‌های به کارگیری تله‌عسل
      • 2‏.‏1‏.‏2 گونه‌های تله‌عسل
      • 2‏.‏1‏.‏3 چالش‌های به کار گیری تله‌عسل
      • 2‏.‏1‏.‏4 نمونه‌هایی از تله‌عسل شبکه
    • 2‏.‏2 سامانه تشخیص نفوذ
      • 2‏.‏2‏.‏1 روش‌های تشخیص
      • 2‏.‏2‏.‏2 معماری سامانه‌های تشخیص نفوذ
      • 2‏.‏2‏.‏3 روش‌های برخورد و پاسخ
    • 2‏.‏3 آسیب‌پذیری‌های وب
  • 3 کارهای پیشین
    • 3‏.‏1 راه‌کارهای امنیتی در وب
      • 3‏.‏1‏.‏1 دیواره‌ی آتش پایگاه داده
      • 3‏.‏1‏.‏2 دیواره‌آتش و سامانه‌ی تشخیص نفوذ کاربرد وب
    • 3‏.‏2 تله‌عسل وب
      • 3‏.‏2‏.‏1 تله‌عسل سمت کارسپار
      • 3‏.‏2‏.‏2 تله‌عسل سمت کارگزار
  • 4 روش پیشنهادی
    • 4‏.‏1 معماری
      • 4‏.‏1‏.‏1 پیمانه‌ی پراکسی
      • 4‏.‏1‏.‏2 پیمانه‌ی تصمیم‌گیر
      • 4‏.‏1‏.‏3 پیمانه‌ی دام
  • 5 پیاده سازی و ارزیابی
    • 5‏.‏1 پیاده‌سازی
      • 5‏.‏1‏.‏1 پیمانه‌ی پراکسی
      • 5‏.‏1‏.‏2 پیمانه‌ی تصمیم‌گیر
      • 5‏.‏1‏.‏3 پیمانه‌ی دام
    • 5‏.‏2 ارزیابی و واکاوی دستاوردها
  • 6 نتیجه‌گیری و کارهای پیش رو
    • 6‏.‏1 نتیجه‌گیری
    • 6‏.‏2 کارهای پیش رو
  • کتاب‌نامه
  • واژه‌نامه‌ی فارسی به انگلیسی
  • واژه‌نامه‌ی انگلیسی به فارسی
  • واژه‌نامه‌ی پارسی به فارسی
  • واژه‌نامه‌ی فارسی به بارسی
...see more