A case study on host based data analysis & cyber criminal profiling in Honeynets

The single detection component of Honeynet i.e. Snort is not sufficient to reasonably classify the total Honeynet malicious domain. The critical issue is the realization of detection layers for enhanced analysis of cyber threats. This paper presents significance & results obtained following integration of host layer in the form of open source HIDS (Host based Intrusion Detection System) to already existing network layer i.e. Snort in Gen 3 Honeynet architecture. The investigation is further carried out to extract the intelligence from the enhanced Honeynet system. The resultant Honeynet system enables the forensic profiling of the cyber criminal through the retrieval of critical parameters from Honeynet database. The various attributes for profile generation have been clearly indicated in terms of the Honeynet database key fields to establish a characteristic model of the attacker.