Sereysethy Touch

Getting a head start on an attacker is a difficult problem because the attacker can always take advantage of new weaknesses and vulnerabilities in the computer system. To address this, in this research Sereysethy focuses on using an adaptive honeypot named Asgard using the SSH protocol as a decoy system intended to be attacked and compromised. This honeypot relies on reinforcement learning algorithms to maintain interaction with the attacker for as long as possible, to capture attack data that can later be used to discover new attack vectors. Unlike conventional honeypots that can be freely attacked and fully compromised, our new honeypot system has a defensive behavior that can decide to block, substitute the execution of malicious commands and malware, or allow them to run if the system is not completely compromised.