Paradigme de pot de miel adaptatif permettant d'étudier et d'évaluer le comportement et compétences des pirates informatiques

Abstract : Information security communities are always talking about "attackers" but in reality very little is known about their skills.In the last decade the number of attacks has increased exponentially and honeypots were introduced in order to gather information about attackers. Honeypots come in different flavors with respect to their interaction potential. Choosing the best trade-off between attacker freedom and honeypot restrictions is challenging. In this dissertation, we address the issue ofself-adaptive honeypots that can change their behavior and lure attackers into revealing as much information as possible about themselves. Rather than being allowed simply to carry out attacks, attackers are challenged by strategic interference from adaptive honeypots. The observation of the attackers' reactions is particularly interesting and, using derivedmeasurable criteria, the attacker's skills and capabilities can be assessed by the honeypot operator. We formally model the interactions of attackers with a compromised system. The key idea is to leverage game-theoretic concepts to define the configuration and reciprocal actions of high-interaction honeypots. We have also leveraged reinforcement learningmachine learning in order to arrive at the best behavior when facing attackers. Our experimental results show that behavioral strategies are dependent on contextual parameters and can serve as advanced building blocks forintelligent honeypots
Document type :
Theses
Complete list of metadatas

https://hal.univ-lorraine.fr/tel-01749537
Contributor : Thèses Ul <>
Submitted on : Thursday, March 29, 2018 - 12:19:00 PM
Last modification on : Tuesday, April 24, 2018 - 1:31:00 PM
Long-term archiving on : Friday, September 14, 2018 - 9:18:59 AM

File

INPL_2011_WAGENER_G.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : tel-01749537, version 1

Collections

Citation

Gérard Wagener. Paradigme de pot de miel adaptatif permettant d'étudier et d'évaluer le comportement et compétences des pirates informatiques. Other [cs.OH]. Institut National Polytechnique de Lorraine, 2011. English. ⟨NNT : 2011INPL037N⟩. ⟨tel-01749537⟩

Share

Metrics

Record views

72

Files downloads

147