7. Data Analysis
- Overview
- Summary
- Flows
- Details
- Sebek
- Future
![rule](User's Manual Data Analysis_files/rule.gif)
7.1
Overview When you get down to it, the entire purpose
of a deploying a honeynet is to collect data. However, that
data has no value if you cannot analyze it. This was one of
the greatest weakneses of the previous Honeywall
Eeyore, it had no simple way to analyze all that great
data. We hope we have solved that problem with Walleye,
the new Web based user interface to the Honeywall CDROM. To
connect to the Walleye interface, type the following in
your browser (notice this is a secured connection using SSL).
https://ip-address-mgmt-interface
Accessing the Data
Analysis section is the same as accessing the System
Admin section section described in Section
6: Maintaining. You will then be prompted to login. If
this is the first time you have logged in, the default user is
roo and password honey. You will then be
prompted to change the password. If you have already logged in
before, you will need to use the updated login and password.
Once you have gained access, the user interface defaults to
the data
analysis summary section.
![rule](User's Manual Data Analysis_files/rule.gif)
7.2 Summary When
you first come to the data anlysis section, you get the summary
page. This page shows by default your Sensor summary, and
a temporary IP search option (better one is currently under
development). The sensor section gives you an overview of the
activity the honeywall sees. Sensor identification is based on
the management IP address of your Honeywall. If you change the
IP address of your Honeywall, you will have multiple sensors
listed (there is no way to delete old ones). This is a known
issues. We are planning in the future for Walleye to
support multiple honeynets. However, it currently supports
only the local Honeywall it is installed on.
The purpose of the summary page is to give an overview of
honeywall activity. The displayed data is a combination of
argus and snort data wich is grouped as either inbound or
outbound flows. The primary source of information is flow
information from argus. Anything listed as bidirectional is
defined as any flow for which we see data going in both
directions from Client to Server and Server to Client. Total
includes both bidirection and unidirectional flows (such as
inbound scans dropped by a firewall). In addition it shows IDS
alerts and network traffic. Anything in blue you can
click on for more information. For example, if you click on
the identification number of your Honeywall sensor, you will
get an more detailed
overview of all the activity on that sensor. The sensor
detail section provides administrative summary data about the
honeywall and a top talkers report for the last 24 hours. The
admin summary is geared towards distributed environments and
provides a description of the geographic and organizational
location of the honewyall. The top talkers reports shows the
25 most active sources for and destinations of network
connections. If you click on the connection section, it will
give you the flow view for those connections, if you do so on
the ids events, it will take you to the flow view and display
the flows that related to the ids events. If you click on the
host's IP address then you would go to a host summary page.
At the bottom is a menu for querying specific IP based
information. Its relatively self explanotory, as you can
search based on time/date, IP address and/or ports.
![rule](User's Manual Data Analysis_files/rule.gif)
7.3 Flows Flows
Section is where you can get started digging into the
details. Here you will see an overview of all inbound and
outbound connections and related activity. The user interface
starts by showing all the honeypots in order (by destination
IP adddress). You can sort the listing by any of the headers,
such as alerts, etc. If there are multiple pages, you can
access them from the top of the menu. At the bottom left of
the screen is the option to query the flows. Options include
filtering by type of traffic, bidirectional, from honeynet,
all time periods, and Sebek tracked. The filter section allows
you to refine your search by screening out uninteresting data.
For instance, you can ask the system to only show
bi-directional TCP connections initiated from the honeynet. If
you want detailed information on each and every flow for that
IP address, or you want the flows listed in order that they
happen, select the IP address of the system you are interested
in, or the Detailed option at the bottom left and
submit your query.
![rule](User's Manual Data Analysis_files/rule.gif)
7.4 Details This
will take you to the Details
Section section. Here you see connection listed in detail.
These connections are listed in the order they happened, with
the oldest at top and the newest connection at the bottom.
Each line contains detailed information about each connection,
including protocol type, number and bytes of of packets
involved, and OS type of src IP address initiating the
connection. Any Snort alerts related to the connection are
also listed. To the left of each connection you will see
several icons. If you do NOT have Sebek installed on the
honeypot, you will only see two icons for each connection, the
floppy disk and the magnifying glass. Each is explained below.
If you do have Sebek installed on the client, you will see an
additional two more icons on the left, these are described in
detail below in the Sebek section.
Floppy Icon: By clicking on this image, you will be
able to download in pcap format the data related to that
specific flow. Or, if you prefer, configure
your browser to launch your tool of choice to analyze
the pcap data, such as Ethereal. This is an excellent
way for detailed analysis.
Magnifying Glass Icon: By clicking on this image, you
are able to analyze the connection in more detail with
Snort. You get a Flows
Examination section, which allows you to analyze in more
detail any IDS alerts, and Snort packet
decode of the flow.
![rule](User's Manual Data Analysis_files/rule.gif)
7.5 Sebek The
new user interface Walleye also supports the
integration and analysis of Sebek data. However, it only works
with the latest version, specifically the 3.X branch of Sebek.
It does not work with older versions due to the new
capabilities added to Sebek client. The power of Sebek data is
that it captures all of the system activity and gives you the
ability to analyze what happened on the honeypot, even if the
attacker went in encrypted. You know you have Sebek data for a
flow when on the left column there are two additional icons,
specifically a blue arrorw and a graph tree. Each is explained
in more detail below.
Blue Arrow Icon: By clicking on this image, you get
all connections
related to that specific flow.
Graph Tree Icon" This is the most powerful of all
options. It allows you to analyze in details all system
activities, including processes, files opened, etc. The
first screen you get will be a visual
graph tree of all the processes and their childs. This
gives you a visual presentation of all the processes. You
can click on specific processes for more information and
drill down of the processes themselves. In addition, if you
click on the option at the top View Details for this
Process, you should get a detailed
listing of all the Opened Files and Read Activity.
![rule](User's Manual Data Analysis_files/rule.gif)
7.6 Future Of
all the functionality of the CDROM, the one that will go under
the most active development and change is the data analysis
user interface. We have a tremendous amount of features we are
attempting to add. Some of these include
- Suspicious Tracking: The ability to highlight any
suspicious connection indicating a compromise.
- Sebek Interface: Ability to quickly determine the
attacker's activities based on Sebek data, such as their
keystrokes, or recover files they uploaded.
- Reporting: Ability to generate reports on
activity
- Distributed: Ability to correlate and analyze
data from multiple honeynets.
![rule](User's Manual Data Analysis_files/rule.gif)
<-Back
Home
Next->
|