Implementing high interaction honeypot to study SSH attacks

Honeypot is a recent technology in the area of computer network security. Production systems that are connected to the Internet are the main target for various cyber attacks. This paper presents a deployment of honeypot system in campus network. The system implements high-interaction honeypot with Secure Shell installed to study common SSH attacks in Linux environment. This system records usernames and passwords that are attempted by intruder from the Internet. It also captures detail activities of the attackers while they are interacting inside the target honeypot. Intruders attack SSH servers through dictionary and brute-force mechanism followed by intrusion. This paper covers both dictionary attack and intrusion.