HoneyGen: An automated honeytokens generator

Maya Bercovitch, Meir Renford, Lior Hasson, Asaf Shabtai, Lior Rokach, Yuval Elovici

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Honeytokens are artificial digital data items planted deliberately into a genuine system resource in order to detect unauthorized attempts to use information. The honeytokens are characterized by properties which make them appear as genuine data items. Honeytokens are also accessible to potential attackers who intend to violate an organization's security in an attempt to mine information in a malicious manner. One of the main challenges in generating honeytokens is creating data items that appear as real and that are difficult to distinguish from real tokens. In this paper we present "HoneyGen" - a novel method for generating honeytokens automatically. HoneyGen creates honeytokens that are similar to the real data by extrapolating the characteristics and properties of real data items. The honeytoken generation process consists of three main phases: rule mining in which various types of rules that characterize the real data are extracted from the production database; honeytoken generation in which an artificial relational database is generated based on the extracted rules; and the likelihood rating in which a score is calculated for each honeytoken based on its similarity to the real data. A Turing-like test was performed in order to evaluate the ability of the method to generate honeytokens that cannot be detected by humans as honeytokens. The results indicate that participants were unable to distinguish honeytokens having a high likelihood score from real tokens.

Original languageAmerican English
Title of host publicationProceedings of 2011 IEEE International Conference on Intelligence and Security Informatics, ISI 2011
Pages131-136
Number of pages6
DOIs
StatePublished - 22 Sep 2011
Event2011 IEEE International Conference on Intelligence and Security Informatics, ISI 2011 - Beijing, China
Duration: 10 Jul 201112 Jul 2011

Publication series

NameProceedings of 2011 IEEE International Conference on Intelligence and Security Informatics, ISI 2011

Conference

Conference2011 IEEE International Conference on Intelligence and Security Informatics, ISI 2011
Country/TerritoryChina
CityBeijing
Period10/07/1112/07/11

Keywords

  • database generation
  • honeypot
  • honeytoken
  • intrusion detection

All Science Journal Classification (ASJC) codes

  • Artificial Intelligence
  • Information Systems

Fingerprint

Dive into the research topics of 'HoneyGen: An automated honeytokens generator'. Together they form a unique fingerprint.

Cite this