In computer security applications, a honeypot is a trap set on a network to dete

Question

In computer security applications, a honeypot is a trap set on a network to detect and counteract computer hackers. Honeypot data are studied in Kimou et al. (2010) using Markov chains. The authors obtained honeypot data from a central database and observed attacks against four computer ports – 80, 135, 139, and 445 – over 1 year. The ports are the states of a Markov chain along with a state corresponding to no port is attacked.

Let (Xn) n=0 be a SDTMC where Xn represents the port attacked with S = {80, 135, 139, 445, No attack}.

with initial distribution = (0, 0, 0, 0, 1).

1) Write a Python 3 code, that will be estimating the probability each port is attacked after 100 weeks. Be sure to include the following in your code:

a) Simulate 100 weeks of attacks, and repeat the simulation 5,000 times. Compute the probability that each port is attacked after 100 weeks. Use the print function to print your answers.

b) Create a bar graph to show the probability of attacks at each port after 100 weeks. Be sure to title your graph and label the axes.

Explanation / Answer

Based on their design and deployment, honeypots are classified as either production or research honeypots. Research honeypots are run to enable close analysis of hacker activity and how attacks develop and progress in order to learn how to better protect systems against them. Data placed in a honeypot with unique identifying properties can also help analysts track stolen data and identify connections between different participants in an attack.

Production honeypots are placed inside a production network with other production servers in the role of a decoy as part of a network intrusion detection system (IDS). They are designed to appear real and contain information or a resource of value with which to attract and occupy hackers. This ties up the attacker's time and resources, hopefully giving administrators time to assess and mitigate any vulnerabilities in their actual production systems. The information gathered from the honeypot can also be useful in catching and prosecuting those behind an attack. Researchers suspect that some cybercriminals also use honeypots to gather intelligence about researchers, act as decoys and to spread misinformation.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.