Honeynet

Honeynet — bir nechta honeypot, soxta service, network segment va monitoring componentlaridan tashkil topgan deception muhiti. U bitta alohida honeypotga qaraganda attackerning scanning, lateral movement va ko‘p bosqichli hujumlarini kengroq kuzatishga imkon beradi.

Honeynet production tarmog‘iga o‘xshash topologiya yaratishi mumkin, ammo unda real biznes data va haqiqiy privilege bo‘lmasligi kerak.

Tuzilishi

Honeynet quyidagilardan iborat bo‘lishi mumkin:

soxta workstation;
web server;
database;
file share;
identity service;
router yoki firewall;
honey credential;
monitoring sensor;
capture storage.

Har node boshqa rol va zaiflik ko‘rinishini beradi.

Network topologiya

Attacker bir hostga kirgach boshqa node’larni scan qilishi mumkin.

Honeynet:

web
→ application
→ database
→ file server

kabi real architecture’ni taqlid qiladi.

Bu lateral movement va privilege progressionni kuzatishga yordam beradi.

Honeywall

Honeynet va tashqi network orasidagi nazorat componenti ba’zan honeywall deb ataladi.

traffic capture;
egress limit;
connection rate;
protocol monitoring;
attack containment

vazifasini bajaradi.

Attacker honeynetdan boshqalarga zarar yetkaza olmasligi kerak.

Inbound traffic

Internet-facing honeynet automated scan, botnet, exploit va brute-force urinishlarini yig‘ishi mumkin.

Public IP va service bannerlari real nishonga o‘xshatiladi.

Traffic hajmi katta bo‘lsa storage va triage avtomatlashtiriladi.

Outbound control

Compromised node C2ga ulanib malware yuklashga urinishi mumkin.

Research maqsadiga qarab cheklangan outbound traffic observationga ruxsat berilishi ehtimoli bor.

Ammo rate, destination va protocol qattiq nazorat qilinadi.

Production yoki uchinchi tomon tizimiga hujumga yo‘l qo‘yilmaydi.

High-interaction muhit

Real OS va application attackerga chuqurroq harakat imkonini beradi.

Kuzatiladi:

exploit;
shell command;
persistence;
credential theft;
lateral movement;
data staging;
exfiltration urinishlari.

High-interaction node muntazam snapshotdan qayta tiklanadi.

Low-interaction node

Ko‘p port va protocolni yengil emulyatsiya qilish uchun low-interaction honeypotlar ishlatilishi mumkin.

Ular keng scanning signalini yig‘adi.

Shubhali session high-interaction muhitga yo‘naltirilishi mumkin.

Deception asset

Honeynet ichida soxta:

user;
password;
SSH key;
share;
document;
database;
cloud token

bo‘ladi.

Har asset tracking markerga ega.

Attacker qaysi yo‘ldan foydalanganini aniqlash mumkin.

Central monitoring

Honeynet loglari alohida, himoyalangan tizimga yuboriladi.

Telemetry:

packet capture;
DNS;
process;
memory;
file;
authentication;
command;
network flow.

Attacker local agentni o‘chirsa ham network sensor signal beradi.

Time synchronization

Turli honeypot eventlarini bir timeline’ga birlashtirish uchun soatlar sinxron bo‘lishi kerak.

NTP yoki trusted time source ishlatiladi.

Log timestampi timezone va monotonic sequence bilan tushunarli saqlanadi.

Reset

Compromised node uzoq vaqt nazoratsiz qolmaydi.

Jarayon:

evidence olinadi;
sample va log saqlanadi;
node networkdan ajratiladi;
trusted snapshotdan tiklanadi;
deception state yangilanadi;
yangi monitoring boshlanadi.

Attacker yaratgan persistence resetdan keyin qolmasligi kerak.

Honeypot bilan farqi

Honeypot bitta service yoki host bo‘lishi mumkin.

Honeynet esa bir nechta node va ularning network interactionini qamrab oladi.

Honeynet murakkabroq va ko‘proq resource talab qiladi, ammo multi-stage hujum haqida boyroq ma’lumot beradi.

Production deception

Katta alohida laboratoriya o‘rniga production network ichida soxta assetlar tarqatilishi mumkin.

Masalan:

unused IPda service;
soxta share;
honey account;
fake admin URL.

Bu to‘liq honeynet emas, lekin deception fabricga yaqin.

Risk

Honeynet o‘zi security risk yaratishi mumkin:

malware tashqariga chiqishi;
productionga noto‘g‘ri routing;
haqiqiy credential tushishi;
monitoring tizimi compromise;
legal data collection;
patch qilinmagan host.

Architecture review va qat’iy isolation zarur.

Research qiymati

Honeynet yangi:

TTP;
malware family;
command;
exploit sequence;
infrastructure;
credential behavior

haqida ma’lumot beradi.

Natijalar detection rule va threat hunting hypothesis’iga aylantiriladi.

Data control

Honeynetga real customer yoki production backup joylashtirilmaydi. Realistik ma’lumot synthetic dataset bilan yaratiladi. Attacker uni o‘g‘irlasa ham privacy va business zarar bo‘lmasligi kerak.

Fingerprint diversity

Barcha node bir xil image, uptime va bannerga ega bo‘lsa muhit sun’iy ko‘rinadi. Turli OS, service va activity patternlar ishlatilishi mumkin. Biroq diversity maintenance va riskni oshiradi, shu sababli maqsadga yetarli darajada saqlanadi.

Attack path

Honeynet ataylab observable yo‘l beradi, masalan web credentialdan file share’ga o‘tish. Har qadam sensor bilan qamrab olinadi. Attacker productionga emas, nazoratdagi keyingi deception assetga yo‘naltiriladi.

Capacity

Internet-facing honeynet katta scan va malware oqimini olishi mumkin. Capture storage, sample deduplication va retention rejalashtiriladi. Resource limit bo‘lmasa attacker honeynetning o‘zini DoS qilishi mumkin.

Scenario

Honeynet ma’lum threat scenario asosida loyihalanadi. Masalan, internet-facing web serverdan credential topib, ichki file share’ga o‘tish zanjiri. Har node shunchaki tasodifiy zaif server emas, kuzatiladigan attack pathning bir qismi bo‘ladi.

Sensor himoyasi

Attacker monitoring agentini topib o‘chirishga urinishi mumkin. Network TAP, hypervisor telemetry va remote log kabi tashqi sensorlar local hostga to‘liq tayanmaydi. Sensor management interface’i honeynet ichidan ochilmaydi.

Identity deception

Soxta directory user va group’lar real naming conventionga o‘xshashi mumkin. Ammo ular haqiqiy IAM bilan privilege olmaydi. Honey account ishlatilsa darhol alert va source session haqida telemetry yig‘iladi.

Bog‘liq tushunchalar

Honeynet, Honeypot, Honeywall, Deception technology, Lateral movement, Network monitoring, Malware analysis, Threat intelligence, Network segmentation, SIEM