The widespread and ever increasing number of services and devices which expose their interfaces to the Internet make the cyberspace a fertile ground for malware activities. Hence there is a strong demand for cybersecurity solutions ensuring their safe operation. Honeypots are networked computer systems purposely designed and crafted to mimic regular services, operating systems and devices with the goal of capturing and storing information about the interactions with attacking entities and we repute them a crucial technology in the study of cyber threats and attacks. We presents the main features of EMPHAsis, a data streaming analytics system based on high-interaction honeypots, which enables the collection and analysis of relevant data about intercepted malware.
The era of Internet of Things with billions of connected devices has created
an ever larger space for cyber attackers to exploit. In particular, there is a
widespread amount of automated bots scanning and probing the Internet to
search for vulnerable hosts. This has resulted in the need for fast and accurate
detection of possible system vulnerabilities and attackers by means of the
processing of the high-velocity, high-volume data from various sources to discover
anomalies and/or attack patterns as fast as possible to limit the vulnerability
of the systems and increase their resilience. Such data, generated in a real-time
data stream, need a big data streaming analysis [
Even though many big data streaming analytics tools have been developed in
the past few years, their usage in the eld of cybersecurity is not immediate and
calls for new approaches as pointed out in [
It should be noted that the techniques and attack methods employed by
malwares are typically very simple, In fact, the most used attack method is often
brute-forcing login credentials of servers and, consequently, the most heavily
attacked services are Telnet, FTP and SSH services. There are many tools used
in computer security to catch such malicious actions and one e ective solution
involves the usage of honeypots. Honeypots [
Here we present the main features of EMPHAsis, a distributed system
conceived to support malware detection by acting as a high-interaction
honeypot [
While malware's actions may vary depending on the targeted system, there are only few points of interest that need to be observed and analyzed: network information, the commands executed, processes created, kernel drivers loaded and the les created or modi ed by the malicious agent. Each attacker's action is processed by EMPHAsis according to the functional architecture depicted in Figure 1 discussed next. The system operates by constructing dynamically Proxy
Scheduler virtual environments (sandboxes) to which all tra c generated by the attacker is redirected out. Each environment is equipped with several specialized probes, whose goal is to monitor in a completely transparent way to the malicious entity, speci c critical events that occur in the attack scenario at hand. All the data collected by the probes is eventually stored and indexed for subsequent use (e.g., in order to devise appropriate countermeasures) and possible disclosure.
In more details, the EMPHAsis architecture consists of several modules each of which is in charge of performing a speci c task. The core is the most important module which plays the role of coordinating the operations between all the other modules of the system. Furthermore, it provides a graphical environment for managing the system, to help real-time monitoring and to visualize the collected data. When a connection attempt reaches the system, the agent module checks whether there is a con gured service to handle the request. If a suitable service exists, a virtual trap environment is built and executed on the y and all the attacker's tra c is then redirected out to it. The upper part of Figure 2 shows the main steps performed by the agent module in response to an attack. In more detail, as a preliminary step the proxy component noti es a new connection arrival to the core module while collecting also information about the geographical origin of the attack. Then, it continues by performing payload detection and if a suitable service is found, the request is handled and the scheduler component is allerted. The scheduler is the main responsible for the virtual trap environment setup. After receiving an alert from the proxy, it prepares and starts the sandbox and then injects one or more probes directly into the isolated environment. These probes will monitor all the actions performed by the attacker (or malware) inside the sandbox. In particular, in the lower part of Figure 2 is shown an example of a speci c case where four probes are in place and used for monitoring networking events, commands executed in the system Proxy Scheduler 1. Notifies connection 4. Attacker's traffic redirection 3. Probe injection 2. Virtual trap enviroment setup
Sandbox
Agent NPertwoboerk PSrhoeblel PProrocbeess
Network traffic Shell commands IPnrotecrecsespctiroenation Interception Interception
FileSystem Probe Filesystem changes
Interception Exposed service (e.g., SSH)
Logged events are sent to the database
Sandbox
shell, process creations, and changes to the lesystem. It should be noted that
the concrete implementation of these probes poses technical challenges. Indeed,
one needs to use speci c tools and instruments according to the type of operating
system used by the emulated guest machine. Our probes support a custom
32bit Linux kernel and we rely on QEMU-KVM to emulate this platform. Further
implementation details can be found in [
The storage module comprehends one or more nodes in a redundant con
guration whose role is to o er all standard operations for storage and subsequent
consultation of the collected data. An attack can produce a signi cant amount
of information, which therefore needs to be properly cataloged and organized
for subsequent consultation. To this end, our system exploits appropriate
components for the storage and processing of such information, making it suitable
for the production of detailed reports and in characterizing the threats detected.
Additionally, the above processing can be customized by the user for the
speci c resources she is most interested in. In particular, an individual storage node
uses both a MongoDB NoSQL database [
A key aspect in order to achieve e ective results (in terms of number of
malicious actions logged and malware instances intercepted) concerns the correct
positioning of the honeypots in the infrastructure to be protected. Thus, there
is signi cant motivation for studying the best possible locations where agent
modules (and honeypots in general) can be deployed in a network. Interestingly,
EMPHAsis agents can be deployed both behind or outside the perimeter of
the network, therefore allowing to detect also potential insider threats. In any
case, deploying honeypots in a production environment can be problematic since
it could expose the network to far greater risks than the threats from which
it is intended to be protected. Towards this end, it is essential to study and
analyze the way honeypots interact with the rest of the system before the actual
deployment. This could be done by using virtual simulation environments, such
as the one described in [
All of the security events collected through the probes are sent to the storage module and stored in the Elasticsearch database allowing for fast real-time access through the dashboard. More precisely, we construct a single index which is shared by every probe of any agents running in the system. Figure 3 shows the main panel of the dashboard which displays the information about the active sandboxes, under the control of the core module, and the number of intercepted attacks. The lower part of the panel reports some statistics about the last ve days of operation: the percentage of sandboxes launched, grouped by their type, and the top-10 IP addresses from where the majority of connections to the sandboxes have been established.
It is possible to inspect the details speci c to each sandbox and to access the data collected by the active probes. Figure 4 shows a panel, for a given sandbox, which is organized in more tabs each of which reports speci c information according to the following categories: shell, network, lesystem and processes.
For those sandboxes related to services based on interactive sessions, e.g. ssh or ftp, the ow of messages exchanged (i.e. commands executed and responses) between the attacking entity and the sandbox, is available in the shell logs tab (the one active in the panel of Figure 4). Figure 4 depicts a scenario where the attacker, once logged as the admin user, successfully attempted to download a shell script from a remote host and then executed it inside the sandbox shell environment.
Figure 5 shows the network log tab, which allows to visualize the information about the network events relevant to the service exposed by the sandbox. In the speci c case reported in the gure, some ssh login attempts, part of a brute-force attack directed to gain access as the root user, are visible.
When a malware successfully gain access to a sandbox, from where it is possible to modify the content of the local lesystem, e.g. from a ssh session, such modi cations are tracked and the relevant events (i.e. lesystem related system calls invocations) displayed in the lesystem log tab as shown in Figure 6. Such events are grouped on the basis of the speci c path and ordered by the timestamp of execution.
In a similar way, the processes log tab displays the time intervals when processes launched by a malware from inside the sandbox are executed.
The EMPHAsis probes are able to capture and store in the system database
all the les dropped by an attacker (e.g. shell scripts, binary les, source code)
during a session. Before being stored, such les undergo a basic analysis by
resorting to the malware identi cation and classi cation services o ered by
Virustotal [
We presented the main functionalities of EMPHAsis and it practical
applicability for malware capturing, analysis and prevention. EMPHAsis exploits
highinteraction honeypots and has a modular and extensible architecture making it
e ective and suitable for various practical deployment scenarios. Currently
EMPHAsis features the emulation of Linux based systems on top of which the great
majority of Internet exposed services are based on. Moreover, it can be easily
extended to support other unix-based systems. As a future work, we plan to
support also computer systems based on Microsoft Windows or on Apple macOS.
Another important direction of improvement is the integration of EMPHAsis
with more advanced data analysis tools speci cally tailored to cybersecurity
events, i.e. the so called security information and event management systems
(SIEM), like IBM QRadar [
Acknowledgments This research has been supported by the ISCOM - Italian Ministry of Economic Development under agreement EMPHAsis (CUP B51G17000300006).