Open Access Open Access  Restricted Access Subscription Access

Strengthening MT6D Defenses with LXC-Based Honeypot Capabilities


Affiliations
1 Bradley Department of Electrical and Computer Engineering, Virginia Tech, Blacksburg, VA 24061, United States
 

Moving Target IPv6 Defense (MT6D) imparts radio-frequency hopping behavior to IPv6 networks by having participating nodes periodically hop onto new addresses while giving up old addresses. Our previous research efforts implemented a solution to identify and acquire these old addresses that are being discarded by MT6D hosts on a local network besides being able to monitor and visualize the incoming traffic on these addresses. This was essentially equivalent to forming a darknet out of the discarded MT6D addresses, but the solution presented in the previous research effort did not include database integration for it to scale and be extended. This paper presents a solution with a new architecture that not only extends the previous solution in terms of automation and database integration but also demonstrates the ability to deploy a honeypot on a virtual LXC (Linux Container) on-demand based on any interesting traffic pattern observed on a discarded address. The proposed architecture also allows an MT6D host to query the solution database for network activity on its relinquished addresses as a JavaScript Object Notation (JSON) object. This allows an MT6D host to identify suspicious activity on its discarded addresses and strengthen the MT6D scheme parameters accordingly.We have built a proof-of-concept for the proposed solution and analyzed the solution's feasibility and scalability
User
Notifications
Font Size

Abstract Views: 80

PDF Views: 0




  • Strengthening MT6D Defenses with LXC-Based Honeypot Capabilities

Abstract Views: 80  |  PDF Views: 0

Authors

Dileep Basam
Bradley Department of Electrical and Computer Engineering, Virginia Tech, Blacksburg, VA 24061, United States
J. Scot Ransbottom
Bradley Department of Electrical and Computer Engineering, Virginia Tech, Blacksburg, VA 24061, United States
Randy Marchany
Bradley Department of Electrical and Computer Engineering, Virginia Tech, Blacksburg, VA 24061, United States
Joseph G. Tront
Bradley Department of Electrical and Computer Engineering, Virginia Tech, Blacksburg, VA 24061, United States

Abstract


Moving Target IPv6 Defense (MT6D) imparts radio-frequency hopping behavior to IPv6 networks by having participating nodes periodically hop onto new addresses while giving up old addresses. Our previous research efforts implemented a solution to identify and acquire these old addresses that are being discarded by MT6D hosts on a local network besides being able to monitor and visualize the incoming traffic on these addresses. This was essentially equivalent to forming a darknet out of the discarded MT6D addresses, but the solution presented in the previous research effort did not include database integration for it to scale and be extended. This paper presents a solution with a new architecture that not only extends the previous solution in terms of automation and database integration but also demonstrates the ability to deploy a honeypot on a virtual LXC (Linux Container) on-demand based on any interesting traffic pattern observed on a discarded address. The proposed architecture also allows an MT6D host to query the solution database for network activity on its relinquished addresses as a JavaScript Object Notation (JSON) object. This allows an MT6D host to identify suspicious activity on its discarded addresses and strengthen the MT6D scheme parameters accordingly.We have built a proof-of-concept for the proposed solution and analyzed the solution's feasibility and scalability