This paper presents the results of data analysis from a geographically distributed honeypot network. Such honeypot servers were deployed in Samara, Rostov on Don, Crimea and the USA two years ago. Methods for processing statistics are discussed in detail for secure remote access SSH. Lists of attacking addresses are highlighted, and their geographical affiliation is determined. Rank distributions were used as the basis for statistical analysis. The intensity of requests to each of the 10 installed services was then calculated.
Today network and information technologies determine largely both the current standard of living and the possibilities for the future development of society. Unfortunately, modern telecommunications are inseparable from the attempts of intruders to disrupt their stable operation. These attempts have long been undertaken not by individual criminals, but by well-organised groups of hackers. In recent years, accusations of destructive actions are increasingly heard against states.
Under these conditions, the protection of telecommunications and information infrastructure becomes the most important task for both public services and private companies. For the needs of protection, a special infrastructure is created. This paper will focus on creating one of the types of such an infrastructure, known as a network of honeypot servers.
Network attacks can be divided into two large classes [
• Attacks aimed at intercepting telecommunications and information infrastructure management. These attacks are characterised by penetration into the software of the control system with a subsequent acquisition of superuser rights. It should be emphasised that all attempts to take control are carried out exclusively through network requests.
This classification suggests a way to deal with network threats. In order to successfully counter intrusions aimed at denial of service due to the increased load on the network, it is necessary to uncover the sources of the attack and block them.
To combat control interception, it is necessary to create an infrastructure that allows for recording attacking network requests and analysing them. This is necessary to fully understand the mechanism of attack. In turn, attacking requests can come in two forms. The first type is based on the human factor. This may be the appointment of a simple password for a standard login. The human factor includes a banal betrayal associated with the transfer of information about the features of the protective infrastructure and password system, etc.
Sometimes software failures are used to intercept control, including specially opened backdoors,
which are left at the insistence of special services [
To detect attacking requests, a special approach was proposed known as the honeypot method [
A lot of requests are made to the usual resources on the Internet, both legal and malicious. It is
simply impossible to recognise attacking requests in the general stream. However, we can make such a
resource [
After highlighting information about attacking requests and their sources, we can build a defensive
infrastructure. First, the most vulnerable network services will be allocated based on data on the
number of requests to them. Secondly, the mechanisms and frequency of using any software
vulnerabilities that attackers use will become known. Thirdly, databases of attacking addresses will be
formed, which will simplify their blocking. Fourthly, it will be possible to carry out active measures to
investigate botnets by artificially infecting a honeypot server and tracking the further actions of
intruders [
Finally, data on the intrusion model will allow for the formulation of relevant rules for conducting
an audit of network security [
Measuring infrastructure is required for primary data collection. This infrastructure should include
geographically dispersed servers. This is necessary to further verify the data and exclude random calls
from the general list of attacking requests. The probability of accidental access to two or more
geographically separated honeypot [
Our network of honeypot servers consists of 4 units. Three of them are in the European part of Russia, while one of the servers is installed on a hosting in the USA. When choosing placements, we were guided by the simplicity of the installation process and low-cost hosting. This choice is due to the fact that the data of this study was intended to create protective mechanisms in the Russian segment of the Internet. In addition to coverage, our research also distinguishes a rather long time of collecting statistics, which was more than two years.
The choice of applications installed on the honeypot server was determined by their popularity with users. All honeypot servers have the GNU Debian/Linux operating system installed. A list of protocols, services, associated software, types of attacks, and log files with their location is given in Table 1.
№ 1 2 3
Network protocol or service
VoIP SIP, Internet telephony
4 5 6 7 8 9 10
MySQL, database management system
SMB, universal service to access network resources
Proxy, reseller server with redundancy
SSH, secure remote access
FTP, File Transfer
Protocol
DNS, domain name service Firewall
vsftpd
iptables
Standard ports were used to configure network protocols and services. A list of all active ports open on each of the honeypot servers is given in Table 2. The netstat command was used to output data. udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp udp
To process the primary data from log files with statistics, special scripts were written that operated with regular expressions and extracted the data we needed.
First, we present the data on traffic by ports, which was obtained by analysing NetFlow data for the month. The data on the most loaded ports, depending on the type of protocols, is summarised in the following Table 3.
It should be noted that Table 3 shows data only for the first 10 ports for each type of protocol. The number of flows in the column shows the number of completed flows that transmitted data on a given port. A stream can be viewed as a single connection between devices with fixed IP addresses and ports.
It should be noted that requests were made to all TCP ports without exception, and the number of requests to the most unpopular port exceeded 10 in one month. Requests on the UDP protocol were fixed only to 16743 ports, and 74.5% of UDP ports were not used.
The collected statistics allow us to rank the popularity of attacks for various types of Internet services, which were discussed in Section 3. Table 4 highlights the top ten of the most popular services for hacking.
Here, Winbox is an application for managing MikroTik RouterOS, and rpcbind is a remote procedure call service.
In this section, the paper will present the basic data obtained after processing statistics from the honeypot servers. We emphasise once again that the data in this section is based on the log files of the installed services. Log files in turn contain only the response of the service to external requests. In this 1422/asterisk 1422/asterisk 453/rpcbind 463/rpc.statd 1422/asterisk 1422/asterisk 1422/asterisk 1422/asterisk 618/(squid-1) 1422/asterisk 1422/asterisk 463/rpc.statd 478/named 478/named 453/rpcbind 1422/asterisk 1422/asterisk 1104/nmbd 1104/nmbd 1104/nmbd 1104/nmbd 1104/nmbd 1104/nmbd 1422/asterisk 1422/asterisk 1422/asterisk 1422/asterisk 1422/asterisk 1422/asterisk 453/rpcbind 618/(squid-1) 453/rpcbind 463/rpc.statd section, we attempt to classify threats based on these responses. The full content of the request in most cases remains unknown to us.
TCP
At the beginning of the section, we will show how data is processed using the SSH server as an example. This is a remote-control service of the operating system, each session of which is protected using encryption, including the transfer of a password for user identification. Data was collected during 2017-2019, with the total period exceeding one year. Information about the size of the collected data is available in Table 5.
1.20 Gb
Since the data on the honeypot server was not announced in any way (either through DNS, or registration in a search engine, or in IP telephony, etc.), all requests to the specified IP address can be considered suspicious. More suspicious are calls to the SSH server installed as part of the honeypot.
Attacking requests can be divided into two categories. The first of these should include requests for the selection of a pair: username and password. If the password is the simplest, then there is a chance to get access to the system management via a small search. The second category of attacking requests attempts to exploit the identified vulnerabilities of software implementing the server-side of the SSH protocol. It should be noted that such requests are quite difficult to identify using the analysis of log files, since this one contains only system responses.
Table 6 contains data on the number of unique addresses that sent requests to the honeypot server.
A comparison of the data in Tables 6 and 7 shows that IP addresses are sending requests unevenly. Among them are random devices that send requests by mistake, and they should be removed from the final blacklist. In order to understand how irregularly the various devices perform requests, we constructed a rank distribution. Using specially written scripts, we will determine how many times ni requests were sent from one IP address or another during the statistics collection period. Then we arrange these addresses in descending order of the number of requests ni before enumerating these addresses according to the resulting queue. The dependence of the number of requests ni on the place in the ordered list i is the rank distribution. Usually it is depicted on a graph with logarithmic axes lg(ni) and lg(i). The resulting graph can be found in Figure 1.
The most active IP addresses managed to send about a million requests to the SSH server. At the same time, a significant part of the addresses turned out once.
The next part of the analysis is devoted to the coincidence of attacking nodes for a geographically distributed network of honeypot servers.
Table 8 shows data on the number of matched IP addresses sending requests to SSH for each pair of honeypot servers.
The total number of unique addresses that sent requests to this honeypot is on the diagonal. The number of matching IP addresses for the two honeypot servers is indicated in the cell below the diagonal. Above the diagonal is the corresponding percentage.
Table 9 shows data on the number of addresses from which requests were sent to three and four traps.
However, the graph from Figure 1 shows that the number of requests from a single IP address can vary greatly. We need to understand how this number is distributed and how many requests are the same for two, three and four honeypots. Table 10 shows the pairwise matching of requests for honeypot servers.
Comparing the data in Tables 8 and 9 shows that matching requests originate from IP addresses from the top of the rank distribution. That is, the same attacking servers make the selection of the password, while the addresses from the tail of the rank distribution most likely accessed only one honeypot server, and only then by chance.
Crimea Rostov on Don
Samara
USA
Table 11 contains data on the number of matching requests for 3 and 4 honeypot servers. The greatest correlation between attacking requests is observed on Russian honeypots.
Crimea, Rostov on Don, USA Crimea, Samara, USA Rostov on Don, Samara, USA Crimea, Rostov on Don, Samara, USA
In conclusion, we would like to discuss the question of the criteria for including an address in the blacklist of attacking addresses. Based on these criteria, a blacklist should be made.
The criteria are based on two basic properties: the repeatability of the attacking actions and their geographical distribution. That is, from an IP address listed in the blacklist, attacks must be made at least three times. The target of these attacks should be at least two honeypot servers. As a result of data processing, 7 475 addresses were included in the blacklist.
The diagram in Figure 2 shows the distribution of IP addresses from the blacklist by country. The diagram in Figure 3 shows the distribution of attacking requests by country.
The ordinate axis delayed the number of requests to the Samba service for the week. Data was taken from a honeypot server located in the USA. The intensity of the attack has increased dramatically since November 2017. Since September 2018, the intensity of the attacks has returned to background values. More than 860 thousand IP addresses sent requests to the American honeypot. In Russia, the intensity of the attacks was an order of magnitude less, and the greatest activity of the attacks was recorded in Rostov on Don.
After the log files for all ten Internet services are processed, we would like to see the comparative tables for the main types of variables that characterise the attacks. The first of these tables should contain data on the number of addresses in the blacklist for each service installed as part of the honeypot.
Naturally, the largest list of attacking addresses can be obtained by using a firewall. It detects a request on any ports and types of protocols, and therefore the size of its blacklist is the most complete. It contains the attacking addresses of all network protocols. It is surprising that the second place in the number of attacking addresses is the Samba service, which allows us to access disks and printers from various operating systems.
Another useful type of information on the structure of intrusions is the analysis of countries attacking requests and their IP addresses can be linked back to. Such information is compiled in
The data in these tables convincingly indicates from which country the vast majority of attacks are carried out. France, China and the USA can be attributed to the top three of such countries.
Also, the data of Tables 12, 13, 14 allow us to distinguish the main types of intrusions. Password pickup is the greatest threat (a simple password is up to 90% of all hacking incidents). Software flaws are the second most common threat. Data analysis shows that the largest number of holes can be found in the Samba service, but critical vulnerabilities can also occur in web servers, databases and mail servers.
In this paper, we presented a series of results that were obtained using the honeypot method. By honeypot we mean a server on which 10 of the most popular Internet services are installed. This server is installed anonymously, without notification and registration, but on a public IP address. Therefore, repeated requests to the honeypot server can be considered suspicious.
Analysis of the log files of the network of honeypots, whose servers are scattered around the world, allow us to make a network intrusion model. This model consists of a number of elements. This paper presents the statistics of calls by ports and protocols and analyses the popularity of installed Internet services.
The processing of the received data is considered in detail using the example of the operating system remote control service SSH. First of all, the rank distribution is constructed for the number of requests to SSH. There is also a correlation between addresses attacking geographically distributed honeypot servers. The rules for blacklisting the IP addresses of attacking addresses are discussed and fixed.
In addition to statistics for one of the services, data is presented for honeypot servers as a whole. The sizes of blacklists for all 10 services are compared, and the intensity of requests to each of the services is given. Separately, we analysed the geographical affiliation of attacking addresses and requests. For each of the services, the first 3 countries are allocated, the IP addresses of which provide the largest number of attacking requests.
The volume of data obtained is quite large, and in this paper only a small part of the results is given. We expect in the near future to provide new statistics obtained during the processing of the data.
The work was done with the financial support of the Ministry of Science and Higher Education of the Russian Federation within the framework of state task No. 2.974.2017/4.6.