Network Defence on the Cheap: Honeypots as Network Security Monitors

The detection and prevention of malware attacks, particularly from sophisticated botnets, has become an increasingly time consuming task for network administrators. Firewalls and Intrusion Prevention Systems (IPSs) are useful defensive weapons, but how do we know they are effective? This paper looks at the use of honeypots located at different points on a production network so that levels of intrusion could be compared, and the effectiveness of any intervening defensive hardware analysed. Our results showed that the frequency and geographic origin of attacks depended on the Internet service provider and that firewalls and IPSs are effective at defending against external attacks. However, we also demonstrated that honeypots are a useful tool for detecting internal attacks and breaches of network security policy.