{"id":"https://openalex.org/W4381745097","doi":"https://doi.org/10.1109/noms56928.2023.10154330","title":"An SDN-NFV-enabled Honeypot for Manipulating Command & Control Shell TCP Connection","display_name":"An SDN-NFV-enabled Honeypot for Manipulating Command & Control Shell TCP Connection","publication_year":2023,"publication_date":"2023-05-08","ids":{"openalex":"https://openalex.org/W4381745097","doi":"https://doi.org/10.1109/noms56928.2023.10154330"},"language":"en","primary_location":{"id":"doi:10.1109/noms56928.2023.10154330","is_oa":false,"landing_page_url":"https://doi.org/10.1109/noms56928.2023.10154330","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5103125571","display_name":"Siyuan Wu","orcid":"https://orcid.org/0000-0002-6546-5779"},"institutions":[{"id":"https://openalex.org/I69356397","display_name":"Xi\u2019an Jiaotong-Liverpool University","ror":"https://ror.org/03zmrmn05","country_code":"CN","type":"education","lineage":["https://openalex.org/I69356397"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Siyuan Wu","raw_affiliation_strings":["Xi’an Jiaotong-Liverpool University,School of Advanced Technology,Department of Communications and Networking,Suzhou,P. R. China,215123"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Xi’an Jiaotong-Liverpool University,School of Advanced Technology,Department of Communications and Networking,Suzhou,P. R. China,215123","institution_ids":["https://openalex.org/I69356397"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058487069","display_name":"Wenjun Fan","orcid":"https://orcid.org/0000-0002-7363-9695"},"institutions":[{"id":"https://openalex.org/I69356397","display_name":"Xi\u2019an Jiaotong-Liverpool University","ror":"https://ror.org/03zmrmn05","country_code":"CN","type":"education","lineage":["https://openalex.org/I69356397"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenjun Fan","raw_affiliation_strings":["Xi’an Jiaotong-Liverpool University,School of Advanced Technology,Department of Communications and Networking,Suzhou,P. R. China,215123"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Xi’an Jiaotong-Liverpool University,School of Advanced Technology,Department of Communications and Networking,Suzhou,P. R. China,215123","institution_ids":["https://openalex.org/I69356397"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I69356397"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"5"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.9612113237380981},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6892978549003601},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5872809886932373},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.5390957593917847},{"id":"https://openalex.org/keywords/shell","display_name":"Shell (structure)","score":0.5020067691802979},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4938698410987854},{"id":"https://openalex.org/keywords/container","display_name":"Container (type theory)","score":0.46746519207954407},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.42737525701522827},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.4198591113090515},{"id":"https://openalex.org/keywords/software-defined-networking","display_name":"Software-defined networking","score":0.41654446721076965},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.18692010641098022},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.14961275458335876}],"concepts":[{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.9612113237380981},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6892978549003601},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5872809886932373},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.5390957593917847},{"id":"https://openalex.org/C2781052500","wikidata":"https://www.wikidata.org/wiki/Q2230313","display_name":"Shell (structure)","level":2,"score":0.5020067691802979},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4938698410987854},{"id":"https://openalex.org/C2781018962","wikidata":"https://www.wikidata.org/wiki/Q5164884","display_name":"Container (type theory)","level":2,"score":0.46746519207954407},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.42737525701522827},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.4198591113090515},{"id":"https://openalex.org/C77270119","wikidata":"https://www.wikidata.org/wiki/Q1655198","display_name":"Software-defined networking","level":2,"score":0.41654446721076965},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.18692010641098022},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.14961275458335876},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C147176958","wikidata":"https://www.wikidata.org/wiki/Q77590","display_name":"Civil engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/noms56928.2023.10154330","is_oa":false,"landing_page_url":"https://doi.org/10.1109/noms56928.2023.10154330","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.41999998688697815,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W2789663798","https://openalex.org/W2375896275","https://openalex.org/W2166943775","https://openalex.org/W1903420481","https://openalex.org/W2158007046","https://openalex.org/W2775236000","https://openalex.org/W2071426633","https://openalex.org/W2349754162","https://openalex.org/W119088923","https://openalex.org/W4253323281"],"abstract_inverted_index":{"A":[0],"honeypot":[1,81,96,126,149,190],"is":[2,24,35,54,59,83,150,174,192],"a":[3,13,21,63,79,94,103,130,157,172,177],"dedicated":[4],"security":[5],"tool":[6],"for":[7,128],"enticing":[8],"and":[9,39,93,117,176,194],"deceiving":[10],"adversaries.":[11],"With":[12],"successful":[14],"intrusion,":[15],"an":[16,124],"adversary":[17,162],"would":[18],"often":[19,60,84],"obtain":[20],"shell":[22,58,75,90,105],"(that":[23],"bind":[25,89],"or":[26],"reverse":[27,104],"in":[28],"accordance":[29],"with":[30],"the":[31,42,56,70,74,88,138,144,147,161,164,170,188],"attack":[32],"sort),":[33],"which":[34],"used":[36],"to":[37,72,86,122,136,152,155,159],"command":[38],"control":[40,73],"(C&C)":[41],"compromised":[43],"machine.":[44],"The":[45,183],"serious":[46],"consequence":[47],"of":[48,143,179],"C&C":[49,57],"must":[50],"be":[51],"controlled.":[52],"As":[53],"well-known,":[55],"sustained":[61],"by":[62],"TCP":[64,76,91,106],"connection.":[65,107],"However,":[66],"many":[67],"honeypots":[68],"lack":[69],"capability":[71],"connections,":[77],"i.e.,":[78],"high-interaction":[80],"(HIH)":[82],"unable":[85],"migrate":[87],"connection,":[92],"low-/medium-interaction":[95],"(LIH/MIH)":[97],"even":[98],"does":[99],"not":[100],"support":[101],"creating":[102],"In":[108],"this":[109],"paper,":[110],"we":[111],"use":[112],"Software":[113],"Defined":[114],"Network":[115,118],"(SDN)":[116],"Function":[119],"Virtualization":[120],"(NFV)":[121],"propose":[123],"SDN-NFV-enabled":[125],"system":[127,191],"providing":[129],"container-based":[131],"covert":[132],"attack-connection":[133],"manipulation":[134],"mechanism":[135],"address":[137],"above":[139],"issue.":[140],"Taking":[141],"advantage":[142],"SDN/NFV":[145],"technology,":[146],"proposed":[148,189],"able":[151],"respond":[153],"dynamically":[154],"build":[156],"shell-container":[158],"deceive":[160],"following":[163],"moving-target":[165],"defense":[166],"principle.":[167],"To":[168],"consolidate":[169],"proposal,":[171],"prototype":[173],"implemented,":[175],"number":[178],"experiments":[180],"are":[181],"conducted.":[182],"experimental":[184],"results":[185],"show":[186],"that":[187],"effective":[193],"efficient.":[195]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}