Analysis and development of improvements to a system honeypot to mitigate attacks on VoIP services

Abstract

The adoption of telephone communications over IP data networks by public and private companies, implemented either by means of proprietary solutions or by free software, it was a fact over the last decae as it is today. On the other hand, it is known that there are many threats in a data network carrying IP-based services that can infringe almost any service and make it not available. In order to mitigate these threats, an attack detection and control system it is required. Acquiring a product of this type can be unaffordable for many companies, especially for state government agencies as, in general, that kind of systems are too expensive. Therefore, because of the importance of having a vulnerability detection system at a reasonable cost, it was proceeded to install and analyze the performance and operation of a honeypot3 system developed at Universidad Blas Pascal, called "Artemisa”. Such a system was sniffing on the Córdoba State Government data network, for collecting and
analyzing the attacks against IP telephony system. After some study and development, a feature for interacting with the perimetral firewall was added to the Artemisa honeypot system, providing an immediate point of defense, allowing the early and immediate blocking of flooding type attacks.