Lessons Learned from the deployment of a high-interaction honeypot

TL;DR

This paper reports on a six-month experimental study of attacker behavior using a high-interaction honeypot, comparing findings with a global network of low-interaction honeypots to derive practical security insights.

Contribution

It provides new insights into attacker behavior through a long-term deployment of a high-interaction honeypot and compares it with low-interaction honeypots worldwide.

Findings

Attacker behaviors vary significantly over time.

High-interaction honeypots reveal detailed attack techniques.

Comparison highlights differences between high- and low-interaction honeypots.

Abstract

This paper presents an experimental study and the lessons learned from the observation of the attackers when logged on a compromised machine. The results are based on a six months period during which a controlled experiment has been run with a high interaction honeypot. We correlate our findings with those obtained with a worldwide distributed system of lowinteraction honeypots.