Enabling an Anatomic View to Investigate Honeypot Systems: A Survey

TL;DR

This survey introduces a novel taxonomy for honeypot systems, analyzing their components and organizational forms to better understand and classify techniques used in honeypot research and development.

Contribution

It presents a new decoy and security program (D-P) based taxonomy for classifying honeypot techniques and applies it to a broad set of existing honeypot systems.

Findings

The taxonomy effectively classifies various honeypot techniques.

It demonstrates the evolution and trends in honeypot development.

The framework aids in understanding the integration of decoys and security programs.

Abstract

A honeypot is a type of security facility deliberately created to be probed, attacked and compromised. It is often used for protecting production systems by detecting and deflecting unauthorized accesses. It is also useful for investigating the behaviour of attackers, and in particular, unknown attacks. For the past 17 years much effort has been invested in the research and development of honeypot based techniques and tools and they have evolved to become an increasingly powerful means of defending against the creations of the blackhat community. In this paper, by studying multiple honeypot systems, the two essential elements of honeypots - the decoy and the security program - are captured and presented, together with two abstract organizational forms - independent and cooperative - in which these two elements can be integrated. A novel decoy and security program (D-P) based taxonomy is proposed, for the purpose of investigating and classifying the various techniques involved in honeypot systems. An extensive set of honeypot projects and research, which cover the techniques applied in both independent and cooperative honeypots, is surveyed under the taxonomy framework. Finally, the taxonomy is applied to a wide set of tools and systems in order to demonstrate its validity and predict the tendency of honeypot development.