{"id":5977,"date":"2025-09-05T13:00:22","date_gmt":"2025-09-05T11:00:22","guid":{"rendered":"https:\/\/cyberawareness.sk\/?p=5977"},"modified":"2026-03-27T12:33:22","modified_gmt":"2026-03-27T11:33:22","slug":"real-time-processing-of-cybersecurity-system-data-for-attacker-profiling-copy-2","status":"publish","type":"post","link":"https:\/\/cyberawareness.sk\/en\/2025\/09\/05\/real-time-processing-of-cybersecurity-system-data-for-attacker-profiling-copy-2\/","title":{"rendered":"Digital evidence in virtual honeynets based on operating system level virtualization"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"5977\" class=\"elementor elementor-5977\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fa18013 e-flex e-con-boxed e-con e-parent\" data-id=\"fa18013\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-9f6d137 e-con-full e-flex e-con e-child\" data-id=\"9f6d137\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dd553b0 elementor-widget elementor-widget-ucaddon_square_icon_box\" data-id=\"dd553b0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"ucaddon_square_icon_box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\n<!-- start Icon Box -->\n\t\t<link id='font-awesome-css' href='https:\/\/cyberawareness.sk\/wp-content\/plugins\/unlimited-elements-for-elementor\/assets_libraries\/font-awesome6\/fontawesome-all.min.css' type='text\/css' rel='stylesheet' >\n\t\t<link id='font-awesome-4-shim-css' href='https:\/\/cyberawareness.sk\/wp-content\/plugins\/unlimited-elements-for-elementor\/assets_libraries\/font-awesome6\/fontawesome-v4-shims.min.css' type='text\/css' rel='stylesheet' >\n\t\t<link id='uc_ac_assets_file_blox_boxed_small_square_icon_box_css_0-css' href='https:\/\/cyberawareness.sk\/wp-content\/uploads\/ac_assets\/blox-boxed-small-square-icon-box\/blox-boxed-small-square-icon-box.css' type='text\/css' rel='stylesheet' >\n\n<style>\/* widget: Icon Box *\/\n\n#uc_square_icon_box_elementor_dd553b0 * { \n\tbox-sizing: border-box; \n}\n\n#uc_square_icon_box_elementor_dd553b0{\n\tfont-family: inherit;\n    transition:0.3s;\n    position:relative;\n}\n\n#uc_square_icon_box_elementor_dd553b0 .blox-boxed-small-square-icon-box-icon{\n\t\n\tposition:relative;\n    display:flex;\n    justify-content:center;\n    align-items:center;\n    transform:rotate(0deg);\n    z-index:2;\n}\n#uc_square_icon_box_elementor_dd553b0 .ue-icon {\n  display:inline-block;\n}\n#uc_square_icon_box_elementor_dd553b0 .blox-boxed-small-square-icon-box-icon > div{\n\t\n\tposition:relative;\n    display:flex;\n    justify-content:center;\n    align-items:center;\n    transform:rotate(-0deg);\n}\n#uc_square_icon_box_elementor_dd553b0 .ue-icon-inner{\n    line-height:1em;\n\t} \t\n\n\n#uc_square_icon_box_elementor_dd553b0 .ue-icon-inner svg{\n    height:1em;\n    width:1em;\n\t} \t\n\t\n.blox-boxed-small-square-icon-box-heading{\n\tfont-size:21px;\n\t}\n\n\n#uc_square_icon_box_elementor_dd553b0:hover\n{\n  position:relative;\n  z-index:1;\n}\n\n\n#uc_square_icon_box_elementor_dd553b0 .ue_box_button\n{\n  text-align:center;\n  text-decoration:none;\n  display:inline-block;\n  transition:0.3s;\n}\n\n\n#uc_square_icon_box_elementor_dd553b0 span.line\n{\n  display:block;\n  position:absolute;\n  top:0;\n  left:0;\n  width:0px;\n  transition:0.3s;\n}\n\n#uc_square_icon_box_elementor_dd553b0:hover span.line\n{\n  width:100%;\n}\n\n#uc_square_icon_box_elementor_dd553b0 .ue-title-separator span\n{\n  display:inline-block;\n  transition:0.3s;\n}\n\n\n\n\n\n<\/style>\n\n<div class=\"square_icon_box \" id=\"uc_square_icon_box_elementor_dd553b0\">\n  \n  \t\t  \n  \n              <div class=\"ue-icon\">\n       <a style=\"display:inline-block; text-decoration:none;\" href=\"https:\/\/web.archive.org\/web\/20180421063047id_\/http:\/\/spi.unob.cz\/papers\/2013\/2013-14.pdf\" >         <div class=\"blox-boxed-small-square-icon-box-icon\" style=\"background-color: ;\">\n           <div class=\"ue-icon-inner\"><i class='fas fa-book'><\/i><\/div>\n         <\/div>\n       <\/a>       <\/div>\n         \n  \t\t        <div class=\"blox-boxed-small-square-icon-box-heading\">\n        \tArticle\n        <\/div>\n          \n  \t\t  \n  \n          \n  \t\t        \n          \n  \t\t  \n<\/div>\n<!-- end Icon Box -->\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad5fbe9 elementor-widget elementor-widget-ucaddon_square_icon_box\" data-id=\"ad5fbe9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"ucaddon_square_icon_box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\n<!-- start Icon Box -->\n\n<style>\/* widget: Icon Box *\/\n\n#uc_square_icon_box_elementor_ad5fbe9 * { \n\tbox-sizing: border-box; \n}\n\n#uc_square_icon_box_elementor_ad5fbe9{\n\tfont-family: inherit;\n    transition:0.3s;\n    position:relative;\n}\n\n#uc_square_icon_box_elementor_ad5fbe9 .blox-boxed-small-square-icon-box-icon{\n\t\n\tposition:relative;\n    display:flex;\n    justify-content:center;\n    align-items:center;\n    transform:rotate(0deg);\n    z-index:2;\n}\n#uc_square_icon_box_elementor_ad5fbe9 .ue-icon {\n  display:inline-block;\n}\n#uc_square_icon_box_elementor_ad5fbe9 .blox-boxed-small-square-icon-box-icon > div{\n\t\n\tposition:relative;\n    display:flex;\n    justify-content:center;\n    align-items:center;\n    transform:rotate(-0deg);\n}\n#uc_square_icon_box_elementor_ad5fbe9 .ue-icon-inner{\n    line-height:1em;\n\t} \t\n\n\n#uc_square_icon_box_elementor_ad5fbe9 .ue-icon-inner svg{\n    height:1em;\n    width:1em;\n\t} \t\n\t\n.blox-boxed-small-square-icon-box-heading{\n\tfont-size:21px;\n\t}\n\n\n#uc_square_icon_box_elementor_ad5fbe9:hover\n{\n  position:relative;\n  z-index:1;\n}\n\n\n#uc_square_icon_box_elementor_ad5fbe9 .ue_box_button\n{\n  text-align:center;\n  text-decoration:none;\n  display:inline-block;\n  transition:0.3s;\n}\n\n\n#uc_square_icon_box_elementor_ad5fbe9 span.line\n{\n  display:block;\n  position:absolute;\n  top:0;\n  left:0;\n  width:0px;\n  transition:0.3s;\n}\n\n#uc_square_icon_box_elementor_ad5fbe9:hover span.line\n{\n  width:100%;\n}\n\n#uc_square_icon_box_elementor_ad5fbe9 .ue-title-separator span\n{\n  display:inline-block;\n  transition:0.3s;\n}\n\n\n\n\n\n<\/style>\n\n<div class=\"square_icon_box \" id=\"uc_square_icon_box_elementor_ad5fbe9\">\n  \n  \t\t  \n  \n              <div class=\"ue-icon\">\n       <a style=\"display:inline-block; text-decoration:none;\" href=\"https:\/\/scholar.google.com\/citations?view_op=view_citation&amp;#038;hl=sk&amp;#038;user=JXxir4oAAAAJ&amp;#038;pagesize=80&amp;#038;sortby=pubdate&amp;#038;citation_for_view=JXxir4oAAAAJ:ns9cj8rnVeAC\" >         <div class=\"blox-boxed-small-square-icon-box-icon\" style=\"background-color: ;\">\n           <div class=\"ue-icon-inner\"><i class='fas fa-link'><\/i><\/div>\n         <\/div>\n       <\/a>       <\/div>\n         \n  \t\t        <div class=\"blox-boxed-small-square-icon-box-heading\">\n        \tLink to Google Scholar\n        <\/div>\n          \n  \t\t  \n  \n          \n  \t\t        \n          \n  \t\t  \n<\/div>\n<!-- end Icon Box -->\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8e851db elementor-widget elementor-widget-text-editor\" data-id=\"8e851db\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Authors: <\/b>Pavol Sokol, Peter Pisar\u010d\u00edk<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-79e945b elementor-widget elementor-widget-heading\" data-id=\"79e945b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Abstract<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b77c4c2 elementor-widget elementor-widget-text-editor\" data-id=\"b77c4c2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The network forensic analysis is the branch of the digital forensic analysis. It focuses on capturing and <br \/>analyzing network traffic in order to identify network threats and attackers and subsequently to obtain <br \/>legal evidence. There are lots of methods suggested for network forensic analysis, including honeypots and <br \/>honeynets. Both are common elements to achieve goals of digital forensic analysis. In this paper we focus <br \/>on virtual honeynets based on operating system-level virtualization. As a representative of this type of <br \/>virtualization, we choose, in order to develop virtual honeynets, an open-source virtualization platform \u2013 <br \/>OpenVZ and FreeBSD jail. Digital evidence is any type of documentation, which satisfies the <br \/>requirements of evidence in proceedings, and digital means that exists just in electronic form. This paper <br \/>offers a discussion about digital evidence, sources of digital evidence, as well as its most important <br \/>requirements, what is necessary for the fulfillment of the validity of digital evidence. Due to these <br \/>requirements, we consider integration of several sensors into the discussed type of virtual honeynet. Our <br \/>implementation of honeynet hence includes sensors in memory (includes buffers, caches, I\/O ports etc.), <br \/>CPU, harddisk drives and network devices. Using these sensors, the digital evidence is stored at the safe <br \/>place. Using OpenVZ and FreeBSD jail technologies enables a user to access all memory blocks, mainly <br \/>the processes, and to identify honeypots (virtual machines, containers), on which the processes are <br \/>running. Thank to this information we are able to detect all changes in processes after intruder penetrated <br \/>the server. Actually, within CPU-based digital evidence we use direct access to CPU from hypervisor <br \/>kernel. We are able to read all registers and all instructions received from and sent to the computer <br \/>processor. This advantage provides malware intrusion detection and analysis. Within the storage-based <br \/>digital evidence we have direct access to the file system and we are able to identify all changes in file <br \/>system, such as file creation and its modification. In this paper we discuss the advantages of OpenVZ and <br \/>FreeBSD jail virtualization platform due to the implementation of the above-mentioned sensors. Since in <br \/>this type of virtualization all virtual environments (honeypots) share one kernel of operating system, it is <br \/>sufficient to implement the sensors in one place only &#8211; in the kernel. Moreover, we describe the high <br \/>effectiveness of such data collection in this paper, as well as we discuss the safe conditions of integral data <br \/>collection, which is necessary to obtain valid digital evidence.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e5a0a23 elementor-widget elementor-widget-heading\" data-id=\"e5a0a23\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Introduction<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-413ae1c elementor-widget elementor-widget-text-editor\" data-id=\"413ae1c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In the present, our everyday lives are becoming more and more dependent on information technologies. <br \/>Due to this fact, the network and information security are areas that require more attention and <br \/>improvement. Traditionally, these areas are primarily intended to be defensive. When the protection of <br \/>the information system is broken and the attacker controls the system, it is necessary to use the tools and<br \/>methods of the network forensic. Network forensics can be defined as the use of scientifically proved <br \/>techniques to collect, fuse, identify, examine, correlate, analyse, and document digital evidence from <br \/>multiple, actively processing and transmitting digital sources for the purpose of uncovering facts related to <br \/>the planned intent, or measured success of unauthorized activities meant to disrupt, corrupt, and or <br \/>compromise system components as well as providing information to assist in response to or recovery from <br \/>these activities [1] . There are lots of proposed models for network forensic that consist of many different <br \/>phases. One of them is honeypot framework, which is explained in detail bellow. <br \/>This paper is organized as follows: In section 2 the theoretical background of honeypots, honeynets, <br \/>virtualization and virtual honeynets is examined. Section 3 presents related works to virtual honeynets and <br \/>virtualization. In section 4 we provide an overview of OpenVZ and FreeBSD jail concept and approaches <br \/>to their implementation. In section 5 we propose virtual honeynets sensors. In section 6 we outline digital <br \/>evidence obtained by proposed sensors. Section 7 offers conclusion of this paper, as well as our opinion on <br \/>the future of these sensors.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Authors: Pavol Sokol, Peter Pisar\u010d\u00edk<\/p>","protected":false},"author":9,"featured_media":5713,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"full-width","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[15],"tags":[],"class_list":["post-5977","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-clanky","entry","has-media"],"_links":{"self":[{"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/posts\/5977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/comments?post=5977"}],"version-history":[{"count":8,"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/posts\/5977\/revisions"}],"predecessor-version":[{"id":8866,"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/posts\/5977\/revisions\/8866"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/media\/5713"}],"wp:attachment":[{"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/media?parent=5977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/categories?post=5977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberawareness.sk\/en\/wp-json\/wp\/v2\/tags?post=5977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}