Know Your Tools: Qebek - Conceal the Monitoring

03 Nov 2010

Abstract

For the last few years, while low-interaction (LI) honeypot systems like Nepenthes and PHoneyC are getting more and more powerful, the progress of high-interaction (HI) honeypot technology has been somewhat slower. This is especially true for Sebek, the de-facto HI honeypot monitoring tool. In this KYT paper, we introduce Qebek, a QEMU based HI honeypot monitoring tool which aims at improving the invisibility of monitoring the attackers activities in HI honeypots.

Authors

  • Chengyu Song
  • Jianwei Zhuge
  • Brian Hay from the Alaskan Chapter.

Download

PDF