Keamanan Jaringan

Honeypot

Bongga Arifwidodobongga@ittelkom-pwt.ac.id

Agenda

• Latar belakang• Pengenalan Honeypot• macam-macam Honeypot• Visualisasi Honeypot dengan ELK

Latar Belakang

Threats Detection Strategy

Honeypot

Ilustrasi :

Honeypot : sistem yang dibuat untuk menjebakHoneynet : kumpulan sistem untuk menjebak

Honeypot

Honeynet

Honeypot - Dionaea

Macam-macam Honeypot :

Tools yang digunakan menurut serangan yang datang :

a. Kippo is an SSH honeypot that can log brute force attacks, where remote the remote attempts to guess logon credentials of an SSH server. Best of all, Kippo is able to record and replay the attacker’s interactions with the emulated shell on the fake SSH server.

b. Glastopf is a web application honeypot. It emulates often-exploited web vulnerabilities, such as remote and local file inclusion and SQL injection. Glastopf examines the attacker’s HTTP request and attempts to respond according to expectations to, for instance, download malicious files.

c. Dionaea is a honeypot for collecting malware. It emulates vulnerabilities in Windows services often targeted by malware, such as SMB, HTTP, TFP and FTP. Dionaea’s handling of the SMB protocol is particularly liked by researchers, as is its ability to emulate the execution of the attacker’s shellcode.

d. Thug is a client-side honeypot (honeyclient) that emulates a web browser. It is designed to automatically interact with the malicious website to explore its exploits and malicious artifacts, often in the form of JavaScript.

Sekilas tentang System ELK

sumber => https://github.com/riupie/honeypot-elk/wiki/Instalasi-ELK-Stack

Tantangan Visualisasi log Honeypot

mengolah log serangan pada Honeypot dionaea untuk dapat di analisis menggunakan engine Elasticsearch kemudian ditampilkan dalam bentuk visualisasi menggunakan engine Kibana.

Engine Kibana

Engine Kibana . . .

Engine Kibana . . .

Agar efektig silahkan kerjakan Tugas berikut :

Carilah informasi meliputi :1. cara kerja/sitem kerja2. kekurangan/kelebihannya

• Kippo• Glastopf• Dionaea• Thug

dikerjakan di kertas jangan lupa tulis nama_nimdikumpulkan jam 14:30 melalui ketua kelas