Technologies used Google Cloud, T- Pot(Open Source) and Machine Learning
Real-time detection and response is one of the most effective way to cyber threats introduced to servers and clients by aggressive, intelligent and sometime real-time attackers. Every node in the network is considered to be a weak point for a potential attacker to take advantage of. Therefore detection and response at endpoint must be extremely effective to erradicate any chances of exposure of such weak points to potential attackers. So as to shift from a traditional approach which fails to detect diverse attack scenarios to a more smart, intelligent way and introduce machine learning to many techniques used to detect and prevent unauthorised access to systems. Thus we look at multiple techniques for different scenarios and advantages of the same.
Network systems contain valuable data and resources that must be protected from attackers. Security experts often use honeypots and honeynets to protect network systems. Honeypot is an outstanding technology that security experts use to tap new hacking techniques from attackers and intruders.The purpose of Honeypot systems is to log every possible malicious activity of an attacker depending on the type of Honeypot system implemented within infrastructure.
Honeypot systems can be used to identify different types of malicious activities such as web applications attacks, known vulnerability exploitation, exploitation of outdated software/system and automated attacks by malicious bots.
• The main aim is to analysis and detect the malicious actors and his attack pattern.
• Prediction of the pattern so that the know attack can be mitigated.
• To use free and open-source technologies and methods to reduce the amount of manual intervention needed to add to or modify high-interaction honeypots.
• Identify malicious IP addresses and vulnerabilities being exploited, so that they can be patched as quickly as possible.
• Discover users that exhibit risky behaviour way before they execute the in tended harm to the network.
• Deploy a number of decoys to lure attackers that get past other defenses.
• To detect attack patterns using machine learning and come out with so lution to mitigate the attacks.
The research designed and implemented a real-time Honeynet system using Machine learning for detecting and preventing system attacks. System services on Apache Webserver, MYSQL,FTP and SMTP were used to lure attackers.The problem nowadays is that a very good hacker will most likely be able to understand when he is attacking a honeypot. Low interaction honeypots will be able to identify mostly automated attack and will hardly be able to understand new hacker method. On the other hand, high interaction systems are here to entrap the hacker and make him give away his techniques and tools to the forensic team. The network administrator implementing this kind of honeypot should make sure that the system is completely isolated from the production network. This is the best defense if the hacker compromises the honeypot.
We have proposed a machine learning model to classify SSH attacks based on the attack nature.
