Roaming honeypots for mitigating service-level denial-of-service attacks

Sherif M. Khattab, Chatree Sangpachatanaruk, Daniel Mossé, Rami Melhem, Taieb Znati

Research output: Contribution to conferencePaperpeer-review

51 Citations (Scopus)


Honeypots have been proposed to act as traps for malicious attackers. However, because of their deployment at fixed (thus detectable) locations and on machines other than the ones they are supposed to protect, honeypots can be avoided by sophisticated attacks. We propose roaming honeypots, a mechanism that allows the locations of honeypots to be unpredictable, continuously changing, and disguised within a server pool. A (continuously changing) subset of the servers is active and providing service, while the rest of the server pool is idle and acting as honeypots. We utilize our roaming honeypots scheme to mitigate the effects of service-level DoS attacks, in which many attack machines acquire service from a victim server at a high rate, against back-end servers of private services. The roaming honeypots scheme detects and filters attack traffic from outside a firewall (external attacks), and also mitigates attacks from behind a firewall (internal attacks) by dropping all connections when a server switches from acting as a honeypot into being active. Through ns-2 simulations, we show the effectiveness of our roaming honeypots scheme. In particular, against external attacks, our roaming honeypots scheme provides service response time that is independent of attack load for a fixed number of attack machines.

Original languageEnglish
Number of pages10
Publication statusPublished - 2004
Externally publishedYes
EventProceedings - 24th International Conference on Distributed Computing Systems - Hachioji, Tokyo, Japan
Duration: Mar 24 2004Mar 26 2004


ConferenceProceedings - 24th International Conference on Distributed Computing Systems
CityHachioji, Tokyo

ASJC Scopus subject areas

  • Software
  • Hardware and Architecture
  • Computer Networks and Communications


Dive into the research topics of 'Roaming honeypots for mitigating service-level denial-of-service attacks'. Together they form a unique fingerprint.

Cite this