\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Network Security in Organizations Using Intrusion Detection System Based on Honeypots},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2012-01-15 (revised: 15 January 2012)}
\def\TheID{\makeatother }
\def\TheDate{2012-01-15}
\title{Network Security in Organizations Using Intrusion Detection System Based on Honeypots}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Dr. Mukta  Rao}

             \affil[1]{  Gurukul Kangri Vishwavidyalaya, Haridwar, India.}

\renewcommand\Authands{ and }

\date{\small \em Received: 15 December 2011 Accepted: 3 January 2012 Published: 15 January 2012}

\maketitle


\begin{abstract}
        


The role of the Internet is increasing and many technical, commercial and business transactions are conducted by a multitude of users that use a set of specialized / sophisticated network applications. Today we face threats of the network which cause enormous damage to the community day by day to the Internet. In this context, the task of network monitoring and surveillance is of utmost relevance and honeypots are promising tools for information and understanding of "areas of interest" of the attackers, and the possible relationship between blackhat teams. In this situation, people are increasingly trying to prevent their network security using traditional mechanisms, including firewalls, Intrusion Detection System, etc. Among them honeypot is a versatile tool for a practitioner security, of course, they are tools that are intended to be attacked or interacted with other information about the attackers, their motives and tools. In this paper, we describe a comparative analysis of various IDS and their usefulness on various aspects. Two major categories of HoneyPot viz. low interaction honeypot and high-interaction honeypot have also been discussed in detail. In this paper, low-interaction honeypot is used as a traffic filter. Activities such as port scanning can be effectively detected by the weak interaction honeypot and stop there. Traffic that cannot be processed by the weak interaction honeypot is delivered over high-interaction honeypot. In this case, the weak interaction honeypot is used as a proxy for high-interaction honeypot then offer optimal realism.

\end{abstract}


\keywords{intrusion detection system, honeypot, network security, ip address mapping.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
o matter how well defended your chicken coop is, a sly fox still finds the hole and carry off the most fat chicken. All the holes do not shut up ... But you can try to catch a fox in a trap by placing it towards a tempting bait, and then -Broads! -Shot at point-blank from a gun. With computers -the same story. The software is vulnerable and prone to all attacks. The timely installation of patches, cuts off only the most stupid of the hacker attacks, and is not accustomed to think of his head. Professional burglars also involved in an independent search for new holes, patches do not stop.\par
This tactic is commonly used for the detection of computer attacks. Vulnerable server is installed in a conspicuous place in the network, safely isolated from all other nodes. This server tracks unauthorized access attempts in real-time transmission of IP-address of the Author ? : Gurukul Kangri Vishwavidyalaya, Haridwar, India. attacker in the FSB or similar bodies. Even if the hacker hides behind clever words (proxy), IDS will still find it and coming out of the trap of an IDS is not an easy task \hyperref[b0]{[1]}\hyperref[b1]{[2]}\hyperref[b2]{[3]}.\par
The server, acting as a decoy, the hacker jargon is called a "honey pot, a network of such servers, respectively, honeynet. A more practical, but more restrictive, definition is given by pcmag.com: "A server that is configured to detect an intruder reflecting an actual production system. It appears as a ordinary server doing a job, but all data and transactions are false. Located inside or outside the firewall, the honeypot is used to learn about techniques intruders, and to identify vulnerabilities in the real system " \hyperref[b3]{[4]}. The etymology of this name goes back to the English belief that if you leave a pot of honey, the bees will fly to it (the hackers). Honeypots \hyperref[b2]{[3]}\hyperref[b3]{[4]} {\ref [5]}\hyperref[b4]{[6]}\hyperref[b5]{[7]}\hyperref[b6]{[8]}\hyperref[b7]{[9]} can be useful for two main purposes. The first relates to an important possible assistance in finding rootkits, Trojans and potential risks of the network. The second objective relates to the chances of obtaining information and understanding of "areas of interest 'of attackers and the possible relationship between "blackhat" teams. Despite the relevance of the problem, only a limited number of works devoted to illustrate the results obtained by inspection of the network are present in the literature \hyperref[b8]{[10]}.\par
The honeypot logs all actions and interactions with users. Since honeypots do not provide legitimate services, any activity is prohibited (and possibly malicious). In practice working of honeypots is being analogous to the use of wet cement to detect human intruders \hyperref[b9]{[11]}.\par
The value of a Honeypot is directly proportional to the quantity and type of information that we can achieve with success from it. In addition to the collection of information, a honeypot has the ability to distract opponents from the most important machines on a network, and can provide warning signs of a new type of attack and exploitation trends, and provides a thorough examination of adversaries during and after exploitation of a host. Another function that allows the capture of Honeypot is key entered by an opponent attempting to compromise the Honeypot -this provides a particularly interesting if an attacker uses the compromised host as an IRC chat server. Two levels of interaction Honeypots are described as low and high interaction.\par
The honeypot was the first publicly available as Deception ToolKit by Fred Cohen in 1998 which was "intended to reveal to attackers as if the system works DTK a large number of known vulnerabilities" \hyperref[b10]{[12]}. More honeypots became both publicly and commercially available throughout the nineties. As began to proliferate from 2000, honeypots proved imperative to capture and analyze the worms. In 2004, virtual honeypots were introduced that allow you to run multiple honeypots on a single server. The paper laid the groundwork for the honeyd project and describes building virtual honeypots which meet help honeypots meet the need to monitor a large network address space \hyperref[b11]{[13]}. A detailed history of honeypots can be found in \hyperref[b12]{[14]} and \hyperref[b13]{[15]}.\par
To resist honeypot is extremely difficult. Externally, they are no different from the normal servers, but in reality are well-disguised Trap \hyperref[b14]{[16]}. One false step and the hacker has nothing to help. 
\section[{II. Inside the pot}]{II. Inside the pot}\par
A typical honeypot is a huge hardware-software complex consisting of the following components: a node-bait, a network of sensor and the reservoir (storage media) \hyperref[b15]{[17]}.\par
There are currently two types of honeypots: a physical honeypot is a real machine with its IP address, and a virtual honeypot is simulated by some another machine that reads network traffic. Physical honeypots are often termed as high-interaction, since the system can be totally compromised and are expensive to install. For instance-if someone wants to implement physical honeypot for a given/specified range of IPs on the LAN, he should create a separate physical honeypot for each IP address. Virtual Honeypots are often labeled as low interaction due to the implementation of low cost maintenance features. The other variety of HoneyPot i.e. virtual honeypot is able to simulate services of multiple operating systems together, and maintain a separate TCP / IP stack for each instance of a Honeypot on that one machine. An example of a virtual honeypot service is Honeyd, which simulates almost all TCP / IP interactions of target multiple operating systems, in order to fool TCP / IP stack fingerprinting tools like Nmap from xProbe. These Virtual honeypots are used more frequently than physical honeypots because they are low in cost as lesser computer systems are required, which eventually reduces maintenance costs. The other advantage is that they provide a greater variety of hosts to be observed.\par
Sensor network is most often realized on the basis of a UNIX-like operating systems, and for monitoring the information tcpdump utility is used or its analogs. Depending on network configuration, the sensor can be found as one of the nodes in this segment of the LAN and a router, located in front of the honeypot \hyperref[b16]{[18]}. Sometimes the sensor network is combined directly with the bait as shown in figure \hyperref[fig_2]{3}. This greatly simplifies and reduces the cost of the system of honeypot, but it weakens the immune system (taking control of the lure, the attacker will quickly discover the sensor and make him safe). Placing the sensor in the broadcast segment gives it the greatest secrecy \hyperref[b17]{[19]}. Network interface sensor may not have its own IP-( D D D D )\par
address, listening to traffic on Stealth-mode, which is achieved by physically cutting the wires transmitting the NIC \hyperref[b15]{[17]}.\par
Dumps collected from tcpdump and others are processed by different analyzers (eg, intrusion detection systems) in the first place that recognize the fact of the attack, and secondly, determining the IP-address of the offender. Intrusion related information ends up in the reservoir, which is the heart of the database. This is the most vulnerable spot of honeypot. Administrator must choose in advance a clear set of criteria to uniquely identify what actions are normal and what are not. Otherwise, the administrator will either be constantly jerking, shivering from each port scanning, or skip lightly modified version of the well-known attacks.\par
There is another problem. If the bait has no other traffic, except for the hacker (which is easy to determine the nature of change in the ID field in the IPpacket headers, details of which were described in an article by wagner \hyperref[b18]{[20]}. Then the attacker shall immediately recognize the trap and will not attack it. If the lure is serving the users outside the network then direct analysis of the traffic dump becomes impossible and the attacker does not cost anything. Very effective bait is a database with credit card numbers or other confidential information (of course, spurious.) Any attempt to access this file, as well as the use of stolen information on the usages of debit cards is a clear indication of cracking. There are other ways to catch offenders, but they are somehow reduced to rigid patterns and, hence, in principle, unable to detect hackers with non-trivial way of thinking. 
\section[{III. Preparation for the attack}]{III. Preparation for the attack}\par
To start the hacker will need a reliable channel of communication from the authorities that could not trace him. Strictly speaking, all channels are monitored, however, the degree of security of each of them different. If you are in a broadcast network, the successful cloning of masking can restrict someone else's IP and MAC-address (of course, cloned vehicle at the time of the attack must be inactive). Provided that the network does not impose any additional equipment to determine the perpetrators, to identify the attacker is practically impossible, although there is a "but." If the machine is vulnerable to hackers, honeypot can quietly throw his computer "bug" with all the ensuing consequences. Many novice attackers are caught in the cookie, passed through a browser. a) Tearing the veil of darkness Before, to rush into battle, you must carefully examine his opponent: to reconstruct the network topology, determine the place of greatest congestion of opposing forces and, of course, to try to identify all the honeypots. The main weapon at this stage, the hacker will attack the port scanner that runs through "dumb" node and therefore concealing reliable IPattacker. Clearly vulnerable server is better to discard, where a high probability of being caught with them are present. It is safest to attack workstations, corporate networks, bred for the firewall (if it really is). The probability of running into a honeypot is minimal. Unfortunately for the attacker, workstations contain a lot less holes than a server-based applications, and therefore to attack here, and nothing in particular.\par
IV. 
\section[{Attack on the Honeypot}]{Attack on the Honeypot}\par
Being by nature common network node, honeypot subject to various DoS-attacks \hyperref[b19]{[21]}. The most vulnerable network sensor is obliged to listen to all the passing traffic. If an attacker can take it out of( D D D D )\par
the game, the fact that the invasion of the system at some time go unnoticed. Naturally, the attacked site should stay alive, otherwise no one will attack. We assume that the sensor to take all the packages, then sending a packet to a nonexistent node, or addressed to any other unnecessary node.  The very same attack is best done over the protocols that are resistant to the interception of traffic, and support transparent encryption, blinding the sensor network. Most often used for this purpose SSH (Secure Shell), however, it limits the choice of attacking only the explicit support of its nodes, which negates the whole advantage of the encryption.\par
V. 
\section[{Drowned in Honey}]{Drowned in Honey}\par
If the attacked site had Honeypots installed, the attacker will not take any success (the vulnerable server silently "eats" an abandoned shell-code, continuing to work properly), or show empty resource does not contain almost anything interesting because Honeypots are dumb stations. In this situation the main thing is not to panic and not to get confused. The first step is to get rid of compromising your Machine by disconnecting from network for some time. Next is to destroy everything related to the attack, software and related files, including temporary. Naturally, the above applies only to attacks on the really serious resources (government websites, banking institutions, etc.). Expect that after breaking someone's home page for you will take seriously, a bit naive. Reinstallation of web-pages will temporarily resolve the issue and then after the behavior/pattern of attack should be made learnt to the IDS. An example of such sequence of actions has been shown in Figure-5 below.  
\section[{Conclusion}]{Conclusion}\par
The strength of honeypot lies in their novelty and obscurity. Hackers are no adequate methods of confrontation with them, however one should not expect that such a balance of power will continue in the future. Architecture of honeypot is still ill-defined and vulnerable. Even today, nothing is impossible for experienced attacker (to bypass honeypots), tomorrow every teenager shall be capable of bypassing such IDS.\par
Honeypots are positioned to become an essential tool for defending the corporate enterprise from hacker attacks, it is a way to spy on your enemies, it might even be a form of concealment. Hackers could be misled into thinking they have achieved a corporate network, when in reality they are just kicking around a honey pot, while the real network remains safe and sound. Honeypots have gained increased prominence in the strategy to protect against intrusions overall business. Security experts do not recommend that these systems replace existing technologies for intrusion detection security, they see the honeypots as a complementary technology to protect against network and host intrusion.\par
The advantages that honeypots provide to intrusion protection strategies are difficult to ignore. In time, as security officials understand the benefits, honeypots will become an essential ingredient in a operation of enterprise-class security. We believe that although honeypots have legal problems now, they do provide useful information regarding the security of a network. It is important that new legal policies be formulated to promote and support research in this area. This will help solve the current challenges and \begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Figure 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-3.png}
\caption{\label{fig_1}Figure 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-4.png}
\caption{\label{fig_2}Figure 3 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{4}\includegraphics[]{image-5.png}
\caption{\label{fig_3}Figure 4 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{5}\includegraphics[]{image-6.png}
\caption{\label{fig_5}Figure 5 :}\end{figure}
 			\footnote{© 2012 Global Journals Inc. (US)} 			\footnote{© 2012 Global Journals Inc. (US) Global Journal of Computer Science and Technology} 		 		\backmatter  			 \par
make possible to use honeypots to benefit the Internet community at large.			 			  				\begin{bibitemlist}{1}
\bibitem[,2542,t=honeypot&i=44335,00.asp PC Magazine's encyclopedia entry for honeypot 5. Intrusion Detection, Honeypots, and incident Handling Resources (2009)]{b3}\label{b3} 	 		\textit{,2542,t=honeypot\&i=44335,00.asp PC Magazine's encyclopedia entry for honeypot 5. Intrusion Detection, Honeypots, and incident Handling Resources},  		 honeypot Definition -PC Magazine. pcmag.com. 24.  		 \url{www.honeypots.net}  		March 2009.  	 
\bibitem[Hussain et al. ()]{b19}\label{b19} 	 		‘A framework for classifying denial of service attacks’.  		 			Alefiya Hussain 		,  		 			John Heidemann 		,  		 			Christos Papadopoulos 		.  	 	 		\textit{Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications},  				 (the 2003 conference on Applications, technologies, architectures, and protocols for computer communications)  		2003. ACM. p. .  	 
\bibitem[Provos ()]{b11}\label{b11} 	 		‘A Virtual Honeypot Framework’.  		 			Niels Provos 		.  		 \url{http://www.citi.umich.edu/techreports/reports/citi-tr-03-1.pdf}  	 	 		\textit{Proceedings of the 13th USENIX Security Symposium},  				 (the 13th USENIX Security Symposium)  		2004. p. .  	 
\bibitem[Anagnostakis ()]{b14}\label{b14} 	 		‘Detecting targeted attacks using shadow honeypots’.  		 			K G Anagnostakis 		.  	 	 		\textit{Proceedings of the 14th conference on USENIX Security Symposium},  				 (the 14th conference on USENIX Security Symposium)  		2005. ACM. p. .  	 
\bibitem[Development of the Honeyd Virtual Honeypot]{b5}\label{b5} 	 		\textit{Development of the Honeyd Virtual Honeypot},  		 \url{www.honeyd.org}  		 	 
\bibitem[Sourour et al. ()]{b2}\label{b2} 	 		‘Ensuring security in depth based on heterogeneous networks security technologies’.  		 			M Sourour 		,  		 			B Adel 		,  		 			A Tarek 		.  	 	 		\textit{International Journal of Information Security}  		2009. 8  (4)  p. .  	 
\bibitem[Talabis ()]{b13}\label{b13} 	 		\textit{Honeypots 101: A Brief History of Honeypots},  		 			Ryan Talabis 		.  		 \url{http://www.philippinehoneynet.org/index2.php?option=com\textunderscore docman\&task=doc\textunderscore view\&gid=2\&Itemid=29}  		2007.  	 
\bibitem[Talabis ()]{b9}\label{b9} 	 		\textit{Honeypots 101: A Honeypot By Any Other Name},  		 			Ryan Talabis 		.  		 \url{http://www.philippinehoneynet.org/index2.php?option=com\textunderscore docman\&task=doc\textunderscore view\&gid=1\&Itemid=29}  		2007.  	 
\bibitem[Spitzner ()]{b4}\label{b4} 	 		\textit{Honeypots: Tracking Hackers},  		 			L Spitzner 		.  		2002. Boston, MA: Addison Wesley.  	 
\bibitem[Spitzner ()]{b12}\label{b12} 	 		\textit{Honeypots: Tracking Hackers},  		 			Lance Spitzner 		.  		2002. Addison-Wesley Professional.  	 
\bibitem[Verwoerd and Hunt (2002)]{b8}\label{b8} 	 		‘Intrusion detection techniques and approaches’.  		 			Theuns Verwoerd 		,  		 			Ray Hunt 		.  		 \url{http://sureserv.com/technic/datum\textunderscore detail.php?id=468}  	 	 		\textit{Computer Communications}  		15 September 2002. p. .  	 
\bibitem[Honeynet (2008)]{b17}\label{b17} 	 		\textit{Know Your Enemy: Honeynets},  		 			Project Honeynet 		.  		 \url{http://old.honeynet.org/papers/honeynet/}  		24 March 2008.  	 
\bibitem[Wagner and Soto ()]{b18}\label{b18} 	 		‘Mimicry Attacks on Host-Based Intrusion Detection Systems’.  		 			David Wagner 		,  		 			Paolo Soto 		.  		 \url{http://www.scs.carleton.ca/\textasciitilde soma/id-2007w/readings/wagner-mimicry.pdf}  	 	 		\textit{Proceedings of the 9th ACM conference on Computer and communications security},  				 (the 9th ACM conference on Computer and communications security)  		2002. ACM. p. .  	 
\bibitem[Mukherjee et al. (1994)]{b16}\label{b16} 	 		‘Network Intrusion Detection’.  		 			B Mukherjee 		,  		 			L Heberlein 		,  		 			K Levitt 		.  	 	 		\textit{IEEE Network}  		May/Jun 1994. p. .  	 
\bibitem[Project Honey Pot. Available from: www. projecthoneypot.org]{b6}\label{b6} 	 		\textit{Project Honey Pot. Available from: www. projecthoneypot.org},  				 	 
\bibitem[He et al. ()]{b15}\label{b15} 	 		‘Real-Time Emulation of Intrusion Victim in HoneyFarm’.  		 			He 		,  		 			Xing-Yulam 		,  		 			Kwok-Yan 		.  	 	 		\textit{Content Computing},  				 (Berlin / Heidelberg)  		2004. Springer. p. .  	 
\bibitem[Cohen (1998)]{b10}\label{b10} 	 		‘The Deception ToolKit’.  		 			Fred Cohen 		.  		 \url{http://catless.ncl.ac.uk/Risks/19.62.html\#subj11}  	 	 		\textit{The announcement can be},  				March 1998.  	 	 (The Risks Digest 9) 
\bibitem[The Honeynet Project. Available from: www. honeynet.org/project]{b7}\label{b7} 	 		\textit{The Honeynet Project. Available from: www. honeynet.org/project},  				 	 
\bibitem[Münz et al. (2007)]{b1}\label{b1} 	 		‘Traffic anomaly detection using K-means clustering’.  		 			G Münz 		,  		 			S Li 		,  		 			G Carle 		.  	 	 		\textit{Proceedings of GI-IGT Workshop},  				 (GI-IGT WorkshopHamburg)  		September 2007. p. .  	 
\bibitem[Sobh ()]{b0}\label{b0} 	 		‘Wire and wireless intrusion detection system: classification, good characteristics and state of art’.  		 			T S Sobh 		.  	 	 		\textit{Computer Standard Interface}  		2006. 28  (6)  p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
