Improving adaptive honeypot functionality with efficient reinforcement learning parameters for automated malware. Issue 2 (3rd April 2018)

• Record Type: Journal Article
• Authors: Dowling, Seamus; Schukat, Michael; Barrett, Enda
• Is Part Of: Journal of cyber security technology. Volume 2:Issue 2(2018)
• Page Start: 75
• Page End: 91
• Publication Date: 2018-04-03
• Subjects: Honeypot -- reinforcement learning -- adaptive -- malware -- automated; Computer security -- Periodicals; Data encryption (Computer science) -- Periodicals; 005.805
• DOI: 10.1080/23742917.2018.1495375
• Languages: English
• ISSNs: 2374-2917

Abstract

ABSTRACT: This paper presents an intelligent honeypot that uses reinforcement learning to proactively engage with and learn from attacker interactions. It adapts its behaviour for automated malware to optimise the volume of data collected. Malware employs highly automated methods to create a global botnet. These automated methods are used to self-propagate and compromise hosts. Honeypots have been deployed to capture these automated interactions. Machine-learning techniques have previously been employed to retrospectively model botnet interactions. We develop a honeypot that uses reinforcement learning with a specific state action space formalism to interact with automated malware. It compares functionality with similar intelligent honeypots which target human interaction. It also demonstrates that datasets collected from an intelligent honeypot deployment are considerably larger than standard high interaction deployments and existing adaptive honeypots.