Hi,
Just in the middle of writing up my final year project on Honeypots.
But, I'm struggling with explaining the difference between an IDS and a Honeypot.... can someone help me out?
Preferably, something I can reference.
Thanks
Printable View
Hi,
Just in the middle of writing up my final year project on Honeypots.
But, I'm struggling with explaining the difference between an IDS and a Honeypot.... can someone help me out?
Preferably, something I can reference.
Thanks
Hi Rude,
I cannot give you references right now, I would need to check another couple of my boxes.
At a high level overview:
1. An IDS is just what it says: Intrusion Detection System. You are looking for unusual and (presumably) unauthorised attempts to ingress and possibly egress (with valuable data) your systems.
2. A "honeypot" is a term derived from old fashioned methods of disposing of unwanted flying insects. Wasps, flies and such (Hornets and bees are excluded, but might be inadvertently caught if you design and execute inadequately)
You set up a system that looks like a "real" vulnerable system, and monitor the attack volumes, vectors and so on.
You may use similar analytical tools, but the IDS is designed to protect and monitor a live production environment, whereas the honeypot is intended to draw them in. :)
Thanks for the reply Nihil,
So, I could say that the machine I have setup (XP with KF Sensor), is an Intrusion Detection System by the fact that it logs all activity, and they Honeypot aspect of it is the "vulnerable" system which is luring them in?
Assuming I'm right, I just gotta find a clever way of wording it and find some decent references distinguishing between the two - all the ones I've read so far don't really distinguish between them as well as I'd hoped.
Kind Regards
Well, I have a question: How do they setup a honeypot?
I assume that it must be on the same network on which the original production system is running. This must make the intruders think that they are attacking the main system or network. Now when this is done, there must be some sort of protection installed (may be using firewall) which must block those attacks which come to the orginal system/network.
What sort of set up would prevent this type of attacks?
Hi Rude,
You are basically correct. This is a simple definition of an IDS:
http://en.wikipedia.org/wiki/Intrusion-detection_system
Basically it is a tool for monitoring and reporting systems activity for things that are unauthorised, unusual and so forth. In a way, systems logs can be used for this purpose but they generally contain rather too much detail.
A decent IDS tool will parse the basic "activity log" type data and selectively report items that might be indicative of an intrusion.
Remember that intrusions can occur over the intranet in larger organisations................they are not purely internet phenomena. An organisation faces the same regulatory compliance requirements in respect of unauthorised employees as it does in respect of outsiders.
A "honeypot" is a decoy system set up with deliberate weaknesses and a high profile to attract attacks for the purpose of analysis. It does not mandate an IDS, as the activity logs could be used.
An IDS is a defense, a honeypot is not.
An IDS will never get you charged with "entrapment", a honeypot might.
And NO, you do not set up a honeypot on a production system/network......... that would be foolish in the extreme. ;)
EDIT: These links might be of interest:
http://www.activeworx.org/Default.aspx?tabid=61
http://www.ukhoneynet.org/tools/honeysnap/
This is inaccurate. A passive device such as an IDS is an alerting tool, not a defense mechanism. It alerts you *after* an event has happened, it does not defend against the actual event.Quote:
An IDS is a defense, a honeypot is not.
Honeypots are research tools, IDS devices are alerting tools.
--TH13
Thanks Nihil and thehorse13,
I think I got it sorted now, with appropriate references.:)
Now coming up to the long bit of having to get my results documented.:(
Good point, particularly as Rude is writing an academic paper, so precise definitions are important.
To provide real time protection the system would have to be preventative. So I guess it would be an IPS rather than an IDS?
It is a sign of the times I think, security products are becoming hybridised? like not so long ago you would talk about "Norton AV", "McAfee AV" and so on. Today they are all trying to market "security suites" with all sorts of stuff included.
Rude, please use --TH13's definition, it is the technically correct one............ I am afraid I am getting corrupted by my environment and starting to talk like an "oik" :D
Well can someone tell the answer to my question? (some posts above)?
Well, from what I have read, a company can set it up where they like, but it is usually within a DMZ on their network, as a hacker would find that before their secured network... that's when they want to distract a hacker from their real systems and resources.Quote:
Originally Posted by jockey0109
However, if they wanted a true analysis of their actual network, then they could place it within the normal LAN.
As you have probably already gathered, I'm no expert, so probably totally wrong, lol.
Kind Regards
The answer is, it depends. Requirements drive where, when, how and why you deploy a honeypot. They are not "typically" setup in DMZs or anywhere else. They are setup all over the place for different reasons. There is no such thing as a "normal" honeypot config.Quote:
Originally Posted by jockey0109
For more information than you'll ever want or need on the topic, go here:
http://www.honeynet.org/
--TH13
Thanks TH13. I have already visited the site you have mentioned. It was not too clear and that is why I am asking it here. Anyway thanks alot for the answer and clarification.
This site may help you out some jockey.
http://www.sans.org/reading_room/whi...udies/1465.php
thehorse: Honeypots can be very good at alerting too. I consider them better than IDS because they hardly generate any false positives or false negatives. To put in simple words, IDSs bitch while Honeypots don't. To prove my point, think of a box running a fake service. An attacker will surely SYN the service in the initial scanning phase causing an alert. A clever attacker can mess with the IDSQuote:
Honeypots are research tools, IDS devices are alerting tools.
in many ways to mask his activity. Its really not what honeypots are traditionally made to do; but who the hell gives a sh*t about traditions these days.
well Pfleeger (Pearson - Security In Computing) classifies IDSs into two - passive and reactive. The reactive one is called IPS. But, isn't it an IDS anyway ?Quote:
This is inaccurate. A passive device such as an IDS is an alerting tool, not a defense mechanism. It alerts you *after* an event has happened, it does not defend against the actual event.
Honeypots are IDSs, IDSs are not Honeypots. Honeypots are a subset of IDSs if treated as such.
Honeypots, perhaps do not provide many false pos/negs but they are much more limited in scope than an IDS. They catch very specific types of events while IDS devices capture most, if not, all varieties.Quote:
Honeypots can be very good at alerting too. I consider them better than IDS because they hardly generate any false positives or false negatives.
Reactive IDS devices (IPS) or whatever name you slap to them are intended to be defense mechanisms. The problem is that I have yet to see someone deploy an IPS solution with great success. No one wants to impact the business adversly with a bad IPS rule so most are configured so lightly they barely make a difference.
Another 2 cents...
--TH13