Probing Firewalls of Malware-Infected Networks with Honeypot

Today, regardless of firewalls deployed at the gateway of the local area networks (LAN), the hosts inside the LAN are frequently got infected by malware. Firewall should be the basic protection scheme, but the effectiveness of firewalls has been recently questioned. We propose a federation scheme of Firewall Probe and Honeypot for investigating the firewall type of malware-infected networks. By capturing network scan made on the Internet by honeypot, we can find the malicious source, and we deploy our firewall probe targeting to the source and categorize the network type into Type A (safe) ... Type E (alert). We investigated firewalls remotely in this way for both randomly-selected networks in global and malware-infected networks. The experiment results indicate that about 91.9% of malware-infected networks does not have even basic firewalls, but left of the networks -- 8.1% were well-protected regarding their firewall. Even those well-protected networks certainly made malicious Internet scanning from behind their firewalls.