A Security Framework for the Detection of Targeted Attacks Using Honeypot

Abstract

The reliance on the Internet is growing steadily day by day, making susceptible to various security risks such as code injection, session hijacking, Denial-of-Service attacks, etc. These attacks threaten the CIA triad, that is, Confidentiality, Integrity, and Availability. As a result, ensuring uninterrupted security has become a demanding undertaking. Of all the options available, a honeypot is one of the best security mechanisms an organization can rely on. It is a system used as a trap for threat actors to believe it is a real system. The study of tricks and their attack vectors enables an understanding of potential security vulnerabilities, allowing for the implementation of measures to safeguard assets before any compromise occurs. This work presents the development of a real organizational network on the AWS Cloud, with a focus on enhancing cyber security measures. The network includes an all-in-one honeypot, TPOT, and vulnerable web servers on one server, while a secure web server and database server are deployed on another. The system aims to detect nine different types of attacks, such as DoS, brute force, and XSS, leveraging the T-Pot framework to analyze attack parameters. The crucial aspect of log monitoring is addressed through AWS Cloud Watch, which logs all processes on the connected instances. Additionally, Route 53 health checks are used to analyze traffic levels and implement necessary mitigation strategies. This comprehensive network setup offers a robust defense against potential cyber threats, ensuring the organization's security and enabling proactive measures to safeguard its digital assets. Proposed security framework exhibits the significant results in detecting multiple targeted attacks.