Enhanced Web Browsing Experience Securing Web Traffic with Client Honeypots

透過Honeypots來增強瀏覽網站的安全性

慕和黑(Jorge Orlando Murillo Perdomo)

指導教授 ： 孫宏民

國立清華大學/電機資訊學院/資訊系統與應用研究所/碩士(2014年)

摘要

The Internet is now more than a commodity and has transitioned to be a invaluable service for organizations, companies, and general everyday users. With the enormous and continuous growth, attackers are consistent in creating new methods to prey on vulnerable users. It is now a matter of high importance to secure and protect user data, since many attacks are popularly deployed on malicious Websites. Many commercial enterprise solutions are costly and a sophisticated infrastructure is needed to deploy them. Additionally, these solutions often rely on the vendors to constantly provide signatures or blacklists to make sure the system is up-to-date.

Therefore, the detection of infection by malware is often really complex. Client honeypots have become a popular choice by researchers that aim to detect and analyze drive-by-download attacks. These systems crawl websites and detect if malware or malicious code is present in these websites. The tools are readily available and are relatively easily to deploy and maintain. An approach that allows users to manage their defense systems has proved inefficient as years have passed by due to performance issues and the complexity of maintaining these solutions individually.

In this thesis, we propose a solution to keep networks behind a proxy server secure. Client honeypots can feed the proxy server with newly found malicious websites, the proxy server will access a database of blocked URLs and domains effectively filtering the web access users have. Clients will connect to the proxy server that is coupled with an Internet Content Adaptation Protocol (ICAP). The ICAP system will serve an HTML page when clients visit potentially malicious websites.

關鍵字

客戶端 ； 安全 ； HTTPS ； 伺服器 ； 低成本

並列摘要

無資料

並列關鍵字

Client Honeypot ； Web Security ； HTTPS ； Proxy Server ； Low-Cost

參考文獻

[2] Hongli Zhang Mahmoud T. Qassrawi. Using honeyclients to detect malicious websites, 2010.

[4] The Regents of the University of California. Wepawet. https://wepawet.cs. ucsb.edu/index.php.

[6] Christos Tsantilas AlexRousskov. Feature: Squid-in-the-middle ssl bump. http://wiki.squid-cache.org/Features/SslBump.

[7] Shuo Chen Ziqing Mao Yi-Min Wang Ming Zhang Shuo Chen. Pretty-bad- proxy: An overlooked adversary in browsers’ https deployments, 2009.

[8] Michael Beham Marius Vlad Hans P. Reiser. Intrusion detection and honeypots in nested virtualization environments, 2013.