User Interface of Honeypot

Abstract

Honeypots are the traps disguised information computer resources that record information about attacks.

Keywords

• verdict

-

malicious code, reverse engineering programs, computer attack analysis, physical encoding, data listening, computer blind aid technologies, applications for disabled people.

I. INTRODUCTION

Honeypots are the traps for computer attacks that collect

malicious objects for further analysis [1-9]. A large data stream forces the user of honeypots to work with multiple monitors at the same time or often switch between graphical interfaces on a single monitor.

As an alternative, a sound interface is proposed in this work that allows the user to navigate through a structured set of features and evaluate by ear the verdict of the current object, threat type, and calculation accuracy. The sound interface is based on the original

method of computer attack feature encoding frequencies.

II. SUBJECT AREA STATE

Information security

experts find strings, checksums, signatures, names of operating system objects, and other features by which they determine the verdict of an object under The

Sound User Interface of

Honeypot

using the combinations of sounds at different contained:

Petr Klyucharev

Information Security Department

Bauman Moscow State Technical University

are found [ 24 ].

Scientific literature has publications on the ideas on the use of surround sound in applications for the visually impaired, and publications that mentioned operating systems with a limited set of application software that can be used by ear. However, there are no applications with an audio interface for information security experts [ 17-23 ]. This paper’s aim is filling in the shortage of such tools.

III. PROBLEM FORMULATION

A feature of a computer attack is a tuple ⟨u,v,y,z⟩ containing the name of a potentially dangerous action u ∈ U, Boolean verdict v ∈ Z2, tool name y ∈ Y with which the feature was obtained, and Boolean value of the classification accuracy z ∈ Z2, which implies the verdict confidence or uncertainty. U and Y are the lists of potentially dangerous actions and analysis tools listed in the MITRE ATT & CK computer attack encyclopaedia.

It is required to present a comprehensive set of computer attacks in order to provide navigation by ear and auditory recognition of the verdict, threat type, attack attributes, and calculated classification accuracy.

IV. SOLUTION

We will group all analysis tools into reputational ones–those not requiring the presence of an investigated file, static ones– those not requiring a file to run, dynamic ones–those requiring a file to run in a controlled environment, and hybrid ones that include all the above types of analysis [ 12 ]. We divide the set of collected computer attack features into four lists, depending on the complexity of the analysis to which the y tool belongs. = ∈ 4 , 4 = {0,1,2,3}, ∀ ∈ (1)

We divide each list into twelve parts and assign the ith attribute the index j equal to the number of the part in which it is 12 ⌋ , ∈ {0,1,2, … ,11}, (2) where n is the length of the feature list.

The user can navigate through the feature list by using the keyboard. By clicking the up-arrow (down-arrow), the user can increase (decrease) the number of the current feature i. Scrolling is cyclical so from the last part one gets to the first one. Index j is incremented when the current feature reaches such value ′ that ′: ⌊ 12 ′ ⌋ > ⌊ 12( ′ − 1)

⌋

Navigation through the twelfth parts of features can be

presented as a cyclical group ( 12, +) with respect to the operation of moving to the twelfth part of the feature list which is some PageDown (PageUp) away from the current part. No more than 11 clicks per unit time are taken into account. PageDown (PageUp) clicks increase (decrease) the number of the displayed part and move I to the beginning of another twelfth part of the list ′ depending on the number of clicks k: ′: ( + ) ′: ⌈

∙ ′⌉ , 12 { where , ′, ∈ 12. the current feature i is incremented. Scrolling through the list is cyclical, i.e. from the last part, we go to the first one. The index j is incremented when the number of the current attribute reaches

Let's represent the set of indices j in the form of a cyclic

group (Z12, +) with respect to the operation of transition to the next twelfth of the list of attributes.

The input alphabet A for encoding in the sound interface is

list N12, verdict K2, and classification accuracy M2 [ 25 ]. the Cartesian product of analysis complexity 4, position in the = 4 × 12 × 2 × 2 contain three elements, and the other six parts contain two elements 3*6 + 2*6 = 30. The index j is the number to which the ordinal number belongs.

The output alphabet B is the set of piano key sounds. The sound wave generated by pressing the piano key is described by the sum of harmonic oscillations: =1 = ∑ 0

( + 0 ), initial phase of the kth component. where x0k is the amplitude, ωk is the circular frequency, φ0k is the (3) (4) (5) (6) (7) (8)

At any time, a user listens to one sound recording. Then they move on to the next sound recording, i.e. the next feature. It is important that by increasing the pitch one can understand how many elements are left in the list. An exceptional case will be with only one attribute in the list. To distinguish a list with one attribute from a list with an excessively large number of attributes, one can introduce an additional sound signal.

After listening to the sound sequence, one can request a

verbal explanation. If an explanation is not contained in the dictionary, the interface will spell it out. The user can voice any spelled or dictionary explanation independently by recording their speech using a microphone.

V. CONCLUSIONS

The proposed method for sound encoding of computer attack

data allows one to perform part of a virus analyst’s tasks by ear. This reduces eye fatigue and opens up the possibility of professional work for the visually impaired. In the future, it will be possible to refine the encoding method using surround sound to display a large number of objects. [1] [2] [3] [4] [5] [6] [7] [8] [9] McGraw-Hill posobie.

–

M.: Cham.

References

Vishnevsky A.S. Content based attack detection in web-oriented honeypots . Voprosy kiberbezopasnosti [Cybersecurity issues] , 2018 . No 3. P. 54 - 62 . DOI: https://doi.org/10.21681/ 2311 -3456-2018-3- 54 -62

Bilinski M. , Gabrys R. , Mauger J . Optimal Placement of Honeypots for Network Defense . In: Bushnell L., Poovendran R. , Başar T . ( eds) Decision and Game Theory for Security . GameSec 2018. Lecture Notes in Computer Science , vol 11199 . Springer, Cham. 2018 . DOI: https://doi.org/10.1007/978-3- 030 -01554- 1 _ 7

Chee Keong NG , Lei Pan , Dr. Yang Xiang . Honeypot Frameworks and Their Applications: A New Framework . In Springer Briefs on Cyber Security Systems and Networks . Springer, Singapore. 2018 . DOI: https://doi.org/10.1007/ 978 -981-10-7739-5

Papazis , K. & Chilamkurti . Detecting indicators of deception in emulated monitoring systems . Service Oriented Computing and Applications . 2019 . Vol. 13 . P. 17 - 29 . DOI: https://doi.org/10.1007/s11761-018-0252-2

Sadasivam G.K. , Hota C. , Anand B . Honeynet Data Analysis and Distributed SSH Brute-Force Attacks . In: Chakraverty S., Goel A. , Misra S . (eds) Towards Extensible and Adaptable Methods in Computing. Springer, Singapore. 2018 . DOI: https://doi.org/10.1007/ 978 -981-13- 2348- 5 _ 9

Voronchikhin I. , Ivanov I. , Maximov R. , Sokolovsky S. Masking of Distributed Information Systems Structure in Cyberspace. Voprosy kiberbezopasnosti [Cybersecurity issues] , 2019. No 6 ( 34 ), pp. 92 - 101 . DOI: 10 .21681/ 2311 -3456-2019-6- 92 -101.

Wang , Y. , Guo , Y. , Zhang , L. et al. SWIM: An Effective Method to Perceive Cyberspace Situation from Honeynet . Arabian Journal for Science and Engineering . 2018 . Vol. 43 . P. 6863. DOI: https://doi.org/10.1007/s13369-017-2904-5

Yazov Yu ., Serdechnyy A. , Sharov I . Methodical approach for estimation of efficiency of honeypot system . Voprosy kiberbezopasnosti [Cybersecurity issues] , 2014 , No 1 ( 2 ), pp. 55 - 60 .

Yin W. , Zhou H. , Yang C. ( 2018 ) A Honeyfarm Data Control Mechanism and Forensic Study . In: Li B. , Shu L. , Zeng D . (eds) Communications and Networking. ChinaCom 2017. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering , vol 237 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 -78139-6_ 37

[10] Keim , Y. , Mohapatra , A.K. Cyber threat intelligence framework using advanced malware forensics . International Journal of Information Technology. Springer Singapore . 2019 . DOI: https://doi.org/10.1007/s41870-019-00280-3

[11] Zhang , H. , Yi , Y. , Wang , J. et al. Network attack prediction method based on threat intelligence for IoT . Multimedia Tools and Applications . Springer US. 2019 . Vol 78. P. 30257 - 30270 . DOI: https://doi.org/10.1007/s11042- 018-7005-2

[12] Lu X. , Han J. , Ren Q. , Dai H. , Li J. , Ou , J. Network threat detection based on correlation analysis of multi-platform multi-source alert data . Multimedia Tools and Applications . 2018 . DOI: https://doi.org/10.1007/s11042-018-6689-7

[13] Böhm F. , Menges F. , Pernul G . Graph-based visual analytics for cyber threat intelligence . Cybersecurity . 2018 . Vol 1. P. 16. DOI: https://doi.org/10.1186/s42400-018- 0017 -4u

[14] Barabanov A. , Grishin M. , Markov A. , Tsirlov V . Current Taxonomy of Information Security Threats in Software Development Life Cycle . In: 2018 IEEE 12th International Conference Application of Information and Communication Technologies (AICT) . IEEE (17-19 Oct 2018 , Almaty, Kazakhstan). 2018 , pp. 356 - 361 . DOI: 10 .1109/ICAICT. 2018 . 8747065 .

[15] Yu B. , Fang Y. , Yang Q. , Tang Y. , Liu , L. ( 2018 ). A survey of malware behavior description and analysis . Frontiers of Information Technology & Electronic Engineering , 19 ( 5 ), 583 - 603 . DOI: https://doi.org/10.1631/FITEE.1601745

[16] Monnappa K. A. Learning Malware Analysis. Explore the concepts, tools, and techniques to analyze and investigate Windows malware . Packt Publishing , 2018 . ISBN 978-1-78839-250-1

[17] Frauenberger C. , Noisternig M. 3D Audio Interfaces for the Blind . Proceedings of the 2003 International Conference on Auditory Display , Boston, MA, USA, July 6- 9 , 2003

[18] Belokon' M.V. Komp'juternye tiflosredstva kak faktor obespechenija bezbar'ernoj sredy dlja slepyh i slabovidjashhih v vysshem inkljuzivnom obrazovanii. Komp'juternye nauki i informacionnye tehnologii Materialy Mezhdunarodnoj nauchnoj konferencii . Izdat. centr Nauka. Saratov . 2016 . P. 63 - 67 . ISBN 978-5- 9999 -2651-7

[19] Trunova L. V. , Grechuhina I. A. Organizacija programmno-apparatnoj sistemy po soprovozhdeniju obrazovatel'noj dejatel'nosti v uchrezhdenii professional'nogo obrazovanija dlja obuchajushhihsja s ogranichennymi vozmozhnostjami zdorov'ja // Molodoj uchenyj . - 2018 . - № 24. - P. 324 - 335 . ISSN: 2072 - 0297

[20] Khan , A. , Khusro , S. , Niazi , B. et al. TetraMail: a usable email client for blind people . Universal Access in the Information Society . 2018 . Pp. 1 - 20 . DOI: https://doi.org/10.1007/s10209-018-0633-5

[21] Khan , A. , Khusro , S. Blind-friendly user interfaces - a pilot study on improving the accessibility of touchscreen interfaces . Multimedia Tools and Applications . 2019 . Vol. 78 . Pp. 17495 - 17519 . DOI: https://doi.org/10.1007/s11042-018-7094-y

[22] Červenka P. , Břinda K. , Hanousková M. , Hofman P. , Seifert R. ( 2016 ) Blind Friendly Maps . In: Miesenberger K. , Bühler C. , Penaz P . (eds) Computers Helping People with Special Needs . ICCHP 2016. Lecture Notes in Computer Science , vol 9759 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 -41267-2_ 18

[23] Bhowmick , A. , Hazarika , S.M. An insight into assistive technology for the visually impaired and blind people: state-of-the-art and future trends . Journal on Multimodal User Interfaces . 2017 . Vol 11. Pp. 149 - 172 . DOI: https://doi.org/10.1007/s12193-016-0235-6

[24] Tom M. Mitchell . Machine Learning. Science/Engineering/Math. 1977 . ISBN: 0070428077

[25] Kientzle T. A Programmer's Guide to Sound . Addison-Wesley. 1997 . ISBN 5-94074-014-6

[26] Sidel'nikov V.M. Teorija kodirovanija .: Uchebnoe M. : Fizmatlit , 2008 . - Pp. 324 . ISBN: 978 -5- 9221 -0943-7

[28] Berry C. , Fiore T . Hexatonic Systems and Dual Groups in Mathematical Music Theory. Involve, a Journal of Mathematics . 2016 . DOI: https://doi.org/10.2140/involve. 2018 . 11 .253

[29] Hughes J.R. Using Fundamental Groups and Groupoids of Chord Spaces to Model Voice Leading . In: Collins T., Meredith D. , Volk A . (eds) Mathematics and Computation in Music. MCM 2015. Lecture Notes in Computer Science , vol 9110 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 -20603-5_ 28

[30] Peck R.W. All-Interval Structures . In: Collins T., Meredith D. , Volk A . (eds) Mathematics and Computation in Music. MCM 2015. Lecture Notes in Computer Science , vol 9110 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 -20603-5_ 29

[31] Schlemmer T. Unifying Tone System Definitions: Ordering Chromas . In: Collins T., Meredith D. , Volk A . (eds) Mathematics and Computation in Music. MCM 2015. Lecture Notes in Computer Science , vol 9110 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 -20603-5_ 30

[32] Popoff A. , Andreatta M. , Ehresmann A . A Categorical Generalization of Klumpenhouwer Networks . In: Collins T., Meredith D. , Volk A . (eds) Mathematics and Computation in Music. MCM 2015. Lecture Notes in Computer Science , vol 9110 . Springer, https://doi.org/10.1007/978-3- 319 -20603-5_ 31

[33] Amiot E. Can a Musical Scale Have 14 Generators? . In: Collins T., Meredith D. , Volk A . (eds) Mathematics and Computation in Music. MCM 2015. Lecture Notes in Computer Science , vol 9110 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 -20603-5_ 35

[34] Booth M.D. Primal-Circular Substitutions . In: Agustín-Aquino O. , LluisPuebla E. , Montiel M . (eds) Mathematics and Computation in Music. MCM 2017. Lecture Notes in Computer Science , vol 10527 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 -71827- 9 _ 1

[35] Cannas S. , Antonini S. , Pernazza L. On the Group of Transformations of Classical Types of Seventh Chords . In: Agustín-Aquino O. , Lluis-Puebla E. , Montiel M . (eds) Mathematics and Computation in Music. MCM 2017. Lecture Notes in Computer Science , vol 10527 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 -71827- 9 _ 2

[36] Genuys G. , Popoff A. Homometry in the Dihedral Groups: Lifting Sets from Zn to Dn . In: Agustín-Aquino O. , Lluis-Puebla E. , Montiel M . (eds) Mathematics and Computation in Music. MCM 2017. Lecture Notes in Computer Science , vol 10527 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 -71827- 9 _ 4

[37] Peck R.W. Almost Difference Sets in Transformational Music Theory . In: Agustín-Aquino O. , Lluis-Puebla E. , Montiel M . (eds) Mathematics and Computation in Music. MCM 2017. Lecture Notes in Computer Science , vol 10527 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 319 - 71827- 9 _ 6

[38] Agustín-Aquino O.A. , Mazzola G . Contrapuntal Aspects of the Mystic Chord and Scriabin's Piano Sonata No. 5 . In: Montiel M. , Gomez-Martin F. , Agustín-Aquino O . (eds) Mathematics and Computation in Music. MCM 2019. Lecture Notes in Computer Science , vol 11502 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 030 -21392- 3 _ 1

[39] Popoff A. , Andreatta M. , Ehresmann A . Groupoids and Wreath Products of Musical Transformations: A Categorical Approach from polyKlumpenhouwer Networks . In: Montiel M. , Gomez-Martin F. , AgustínAquino O. (eds) Mathematics and Computation in Music. MCM 2019. Lecture Notes in Computer Science , vol 11502 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 030 -21392- 3 _ 3

[40] Noll T. , Clampitt D . Exploring the Syntonic Side of Major-Minor Tonality . In: Montiel M. , Gomez-Martin F. , Agustín-Aquino O . (eds) Mathematics and Computation in Music. MCM 2019. Lecture Notes in Computer Science , vol 11502 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 030 -21392-3_ 10

[41] Jedrzejewski F. Non-Contextual JQZ Transformations . In: Montiel M. , Gomez-Martin F. , Agustín-Aquino O . (eds) Mathematics and Computation in Music. MCM 2019. Lecture Notes in Computer Science , vol 11502 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 030 - 21392-3_ 12

[42] del Pozo I. , Gómez F. Formalization of Voice-Leadings and the Nabla Algorithm . In: Montiel M. , Gomez-Martin F. , Agustín-Aquino O . (eds) Mathematics and Computation in Music. MCM 2019. Lecture Notes in Computer Science , vol 11502 . Springer, Cham. DOI: https://doi.org/10.1007/978-3- 030 -21392-3_ 30

[43] Ebeling , M. : Neuronal periodicity detection as a basis for the perception of consonance: a mathematical model of tonal fusion . J. Acoust. Soc. Am . 124 , 2320 ( 2008 ). DOI: https://doi.org/10.1121/1.2968688

[44] Bowling D. , Purves D. A biological rationale for musical consonance . Proc Natl Acad Sci USA . 2015 . 112 ( 36 ): 11155 - 11160 . DOI: https://doi.org/10.1073/pnas.1505768112

[45] Ravignani A. , Bowling D. , Fitch W. Chorusing, synchrony, and the evolutionary functions of rhythm . Frontiers in Psychology . Vol. 5 . DOI: https://doi.org/10.3389/fpsyg. 2014 .01118