About the Brazilian Honeypots Alliance

This Project was initiated in 2003, with the objective of increasing the capacity of incident detection, event correlation and trend analysis in the Brazilian Internet space. This project was a partnership among CERT.br and INPE.

CERT.br staff desgined and implemented a network of distributed low-interaction honeypots (using Honeyd), and developed a system to notify the CSIRTs (Computer Security Incident Response Teams) of networks that generate attacks against the honeypots. This network is still operational, and current activities can be found at http://honeytarg.cert.br/honeypots/.

INPE had several graduate students developing research into attack trends and honeypots' data analysis. Later on, some researchers left INPE and are currently at CTI Renato Archer. More information on CTI current areas of research are available below.

CERT.br Activities

CERT.br still maintains and coordinates the Distributed Honeypots Network, now part of the honeyTARG Honeynet Project, a Chapter of the international Honeynet Project.

As part of the activities, CERT.br also maintains:

• Daily statistics for the network flow data directed to honeypots;
• Hourly port summary statistics for TCP/UDP traffic data directed to honeypots, including trends observed;
• Daily summaries with more details about the traffic observed in each honeypot;
• A system to notify the CSIRTs of networks that generate attacks against the honeypots.

CTI Activities

Up to 2008 CTI/MCT developed research activities in partnership with INPE/MCT's graduate students. This research was focused both in developing tools and analysing data collected in honeypots and honeynets.

• Papers written as part of these past activities are available at: http://www.honeynet.org.br/papers/;
• Current DSSI/CTI activities can be seen here: http://www.cti.gov.br/index.php/dssi-apresentacao.html.