WolfTrap: Virtual Dynamic Honeynet Software for Insider/Outsider Defense (VDHS)

Honeynets (and their predecessor – honeypots) have been demonstrated to increase network defense posture by providing deceptive targets for outside attackers and malicious insiders. ISAC, Inc. proposes the development of a virtual, dynamic honeynet software package specifically developed for sensor-to-shooter networks. This approach uses passive network and operating system fingerprinting techniques to automatically configure, update, and maintain virtual honeynets that realistically mimic weapons system components. Attacks directed at a virtual, dynamic honeynet are transparently routed to a sandbox environment, allowing security managers to determine attacker intent and preserve evidence for forensic investigation. Since little-to-no network traffic to a honeynet is legitimate, ISAC’s virtual, dynamic honeypot will provide an accurate detection enhancement (near zero false-positives) to existing intrusion detection deployments and will provide a much-needed defense against the malicious insider problem. In Phase I, ISAC developed the VDHS architecture, demonstrated feasibility of the approach, and developed a proof-of-principle demonstration that automatically configures a virtual honeynet to match the network to which it is connected and detects a malicious insider. In Phase II, ISAC will develop a full-featured prototype that automatically creates a realistic virtual network based on weapon system components, accepts attack redirects from the real network, and interfaces with existing situational awareness components.