We are currently in a period of great interest in cybersecurity, as there are emerging more and more attacks on connected devices. One way we can help improve security is to use honeypots. It is a concept of electronic traps that we place on the network so that they can be attacked and threatened. In the meantime, honeypots acquire attacks data. Most honeypots don't support high interactivity, which makes them vulnerable to detection. To make honeypots as interesting as possible for the attacker we want to simulate a real system with customizable operating system and services. Next, we want to design a central data collection for multiple distributed honeypots. Another challenge is also establishing a scalable and flexible infrastructure. This problem is present at deploying a large number of honeypots, as well as setting up a system for storing and analyzing data.
In the thesis, we first give an overview of the field of honeypots and choose the most suitable honeypot for our task. Then we present the technologies we used in our honeypot system. We describe Docker containers, Kubernetes, and a central data collection system. After that, we describe the individual phases of establishing a highly interactive containerized and distributed honeypot system with remote secure shell access. During each step, we present problems and solutions appeared in the process. We also go into details about the safety of containers and the ways of cleaning and storing data. Finally, we set up a working system and suggest possible improvements.
|
