Application of divide-and-conquer algorithm paradigm to improve the detection speed of high interaction client honeypots

Authors:
Christian Seifert;Ian Welch;Peter Komisarczuk
Affiliations:
Victoria Univestity of Wellington, Wellington, New Zealand;Victoria Univestity of Wellington, Wellington, New Zealand;Victoria Univestity of Wellington, Wellington, New Zealand
Venue:
Proceedings of the 2008 ACM symposium on Applied computing
Year:
2008

Citing 2
Cited 5

A feather-weight virtual machine for windows applications

Proceedings of the 2nd international conference on Virtual execution environments
Toward Automated Dynamic Malware Analysis Using CWSandbox

IEEE Security and Privacy

Automating Malware Scanning Using Workflows

CCGRID '09 Proceedings of the 2009 9th IEEE/ACM International Symposium on Cluster Computing and the Grid
Identification of Malicious Web Pages by Inductive Learning

WISM '09 Proceedings of the International Conference on Web Information Systems and Mining
An efficient visitation algorithm to improve the detection speed of high-interaction client honeypots

Proceedings of the 2011 ACM Symposium on Research in Applied Computation
Anatomy of drive-by download attack

AISC '13 Proceedings of the Eleventh Australasian Information Security Conference - Volume 138
Efficient and effective realtime prediction of drive-by download attacks

Journal of Network and Computer Applications

Quantified Score

Hi-index	0.00

Visualization

Abstract

We present the design and analysis of a new algorithm for high interaction client honeypots for finding malicious servers on a network. The algorithm uses the divide-and-conquer paradigm and results in a considerable performance gain over the existing sequential algorithm. The performance gain not only allows the client honeypot to inspect more servers with a given set of identical resources, but it also allows researchers to increase the classification delay to investigate false negatives incurred by the use of artificial time delays in current solutions.