Distributed Honeypot log management and visualization of attacker geographical distribution

Abstract

Honeypot is a prominent technology that helps us learn new hacking techniques from attackers and intruders. The much information from multiple Honeypot servers, the more appropriate signatures we can generate. To ease the administrator to manage and monitor trace files from multiple Honeypot servers that are distributed in various locations at the same time, in this paper we design and implement a prototype of log management server to automatically and periodically collect log files from them. Information reported by each Honeypot server will be sent in secure manner to the log management server. The log management server then parses the information into the database server, where users can search for specific information through the web interface, such as searching based on one or two Honeypot servers. Moreover, the geographical distribution of attackers is visualized in the world map by utilizing the WHOIS database and GeoPlot software.