@inproceedings{c7b4a439818547eba6e5c14d7f669352,
title = "HoneyGen: An automated honeytokens generator",
abstract = "Honeytokens are artificial digital data items planted deliberately into a genuine system resource in order to detect unauthorized attempts to use information. The honeytokens are characterized by properties which make them appear as genuine data items. Honeytokens are also accessible to potential attackers who intend to violate an organization's security in an attempt to mine information in a malicious manner. One of the main challenges in generating honeytokens is creating data items that appear as real and that are difficult to distinguish from real tokens. In this paper we present {"}HoneyGen{"} - a novel method for generating honeytokens automatically. HoneyGen creates honeytokens that are similar to the real data by extrapolating the characteristics and properties of real data items. The honeytoken generation process consists of three main phases: rule mining in which various types of rules that characterize the real data are extracted from the production database; honeytoken generation in which an artificial relational database is generated based on the extracted rules; and the likelihood rating in which a score is calculated for each honeytoken based on its similarity to the real data. A Turing-like test was performed in order to evaluate the ability of the method to generate honeytokens that cannot be detected by humans as honeytokens. The results indicate that participants were unable to distinguish honeytokens having a high likelihood score from real tokens.",
keywords = "database generation, honeypot, honeytoken, intrusion detection",
author = "Maya Bercovitch and Meir Renford and Lior Hasson and Asaf Shabtai and Lior Rokach and Yuval Elovici",
year = "2011",
month = sep,
day = "22",
doi = "https://doi.org/10.1109/ISI.2011.5984063",
language = "American English",
isbn = "9781457700828",
series = "Proceedings of 2011 IEEE International Conference on Intelligence and Security Informatics, ISI 2011",
pages = "131--136",
booktitle = "Proceedings of 2011 IEEE International Conference on Intelligence and Security Informatics, ISI 2011",
note = "2011 IEEE International Conference on Intelligence and Security Informatics, ISI 2011 ; Conference date: 10-07-2011 Through 12-07-2011",
}