Cutting Edge

Security Congress Abstract

Honeypots and Machine Learning: An Effective Security Tag Team

Co-Speaker(s)

• DR

  David Read, CISSP

  CTO
  infuzIT, LLC
• XG

  Xinyi Gu

  Research Assistant
  infuzIT, LLC

Honeypots have the ability to provide rich data sets that record attacker activity while collecting detailed information about their system interactions. Machine learning leverages predictive analytics to identify models within large data sets. In this session, we will discuss the results of combining these two techniques to automate the search for attacks.

Security automation may be enhanced through the use of honeypots and machine learning techniques. However, there is work to be done to create a useful monitoring platform. Challenges include real-time normalization of diverse data sets, feature identification, model implementation, as well as concept drift leading to stale models. We will discuss these challenges as well as approaches for addressing them in the context of typical honeypot and machine learning environments.

 

Learning Objectives:

• Describe the role of honeypots within an overall security framework.
• Explain the process of applying machine learning in the context of honeypot-based attack identification.
• Implement a proof-of-concept leveraging open-source honeypots and machine learning environments.