The State of the Art in Intrusion Prevention and Detection

95Attack Severity–Based Honeynet Management Framework

The basic task of the framework is to redirect incoming trafc between the honeygroups based

upon the current and future severity of attacks. The administrator has to set the lower bound and

upper bound of probability for such movement. If, for some attacker, the probability of attack shoots

up above the upper bound, the framework redirects its trafc from the current honeygroup to the

next mentioned honeygroup. On the contrary, if the attack probability reduces below the lower

bound, then it is shifted to the honeygroup having a lower level.

4.6.3 deVelopMent of ruleS and working

Our framework is divided into four major modules. They are listed below with their short descriptions:

4.6.3. ...