论文标题
动态蜜罐有效性测量的分类法
A Taxonomy for Dynamic Honeypot Measures of Effectiveness
论文作者
论文摘要
Honeypots是用于捕获未经授权（通常是恶意）活动的计算系统。尽管蜜罐可以采用多种形式，但研究人员认为，该技术对于研究对手行为，工具和技术很有用。不幸的是，研究人员也同意蜜罐难以实施和维护。缺乏有效性的衡量标准使实施问题变得更加复杂。换句话说，现有研究没有提供一系列措施来确定蜜罐是否有效地实施。这是有问题的，因为无效的实施可能导致绩效差，合法服务的仿真不足，甚至是对手的过早发现。因此，我们已经开发了一种分类法，以衡量动态蜜罐实施中的有效性。我们的目的是使这些措施用于量化动态蜜罐在指纹环境中的有效性，捕获对手的有效数据，欺骗对手，并智能监视自己及其周围环境。
Honeypots are computing systems used to capture unauthorized, often malicious, activity. While honeypots can take on a variety of forms, researchers agree the technology is useful for studying adversary behavior, tools, and techniques. Unfortunately, researchers also agree honeypots are difficult to implement and maintain. A lack of measures of effectiveness compounds the implementation issues specifically. In other words, existing research does not provide a set of measures to determine if a honeypot is effective in its implementation. This is problematic because an ineffective implementation may lead to poor performance, inadequate emulation of legitimate services, or even premature discovery by an adversary. Accordingly, we have developed a taxonomy for measures of effectiveness in dynamic honeypot implementations. Our aim is for these measures to be used to quantify a dynamic honeypot's effectiveness in fingerprinting its environment, capturing valid data from adversaries, deceiving adversaries, and intelligently monitoring itself and its surroundings.
