Intelligent Dynamic Honeypot Enabled by Dynamic Fuzzy Rule Interpolation

Dynamic fuzzy rule interpolation (D-FRI) utilises a transformation-based knowledge interpolation mechanism to maintain a concurrent rule base according to the requirements of a given application problem. This feature makes it well-suited for network security applications where the perpetual change in the network conditions and traffic is unavoidable. Honeypots have become an important part of the security work of any organisation, gathering detailed information about an attack and attackers, in an effort to design the most robust protection policy. A honeypot deceives attackers to believe that they are interacting with a real system, thereby hiding its identity. Fingerprinting is one of the biggest threats to any honeypot allowing an attacker to discover the identity of the honeypot since once identified, its usefulness is limited. A number of methods have been proposed to fingerprint a honeypot preventing it from functioning; yet, it is a very challenging task to detect fingerprinting in real-time. This paper presents an intelligent and dynamic honeypot based on the D-FRI approach. The resulting system is capable of detecting certain types of fingerprinting threat in the absence of matching rules, while being able to learn and maintain a dynamic rule base for more accurate identification of possible fingerprinting threats based on the current network traffic conditions.