Title:

Graph-based Forensic Analysis of Web Honeypot, Journal of Telecommunications and Information Technology, 2016, nr 2

Creator:

Studiawan, Hudan ; Pratomo, Adi ; Djanali, Supeno

Subject and Keywords:

access log ; graph agglomerative clustering ; attack type ; visualization of large graphs

Description:

Honeypot still plays an important role in network security, especially in analyzing attack type and defining attacker patterns. Previous research has mainly focused on detecting attack pattern while categorization of type has not yet been-comprehensively discussed. Nowadays, the web application is the most common and popular way for users to gather information, but it also invites attackers to assault the system. Therefore, deployment of a web honeypot is important and its forensic analysis is urgently required. In this paper, authors propose attack type analysis from web honeypot log for forensic purposes. Every log is represented as a vertex in a graph. Then a custom agglomerative clustering to categorize attack type based on PHP-IDS rules is deployed. A visualization of large graphs is also provided since the actual logs contain tens of thousands of rows of records. The experimental results show that the proposed model can help forensic investigators examine a web honeypot log more precisely.

Publisher:

National Institute of Telecommunications

Date:

2016, nr 2

Resource Type:

artykuł

Format:

application/pdf

Resource Identifier:

ISSN 1509-4553, on-line: ISSN 1899-8852

Source:

Journal of Telecommunications and Information Technology

Language:

ang

Rights Management:

Biblioteka Naukowa Instytutu Łączności