The Generation of Attack Signatures Based on Virtual Honeypots

This paper puts forward an automatically generated system of attack signature based on virtual honeypots, which adopts an open source software virtual honeypot-Honeyd, uses the plug-in-supporting function of Honeyd, and sets up Signature Generation System (SGS) to generate attack signature for Snort automatically. SGS carries out the intrusion rule extraction of data packets which have entered Honeyd and compares these rules with the rule library in the Snort. If there exist no similar intrusion rules in the rule library, SGS will automatically create a new rule. Otherwise SGS will update the rule. In this way it automatically updates the rule library of Snort to reduce the miss probability of Snort.