A virtual honeypot framework

摘要: A honeypot is a closely monitored network decoy serving several purposes: it can distract adversaries from more valuable machines on network, provide early warning about new attack and exploitation trends, or allow in-depth examination of during after honeypot. Deploying physical often time intensive expensive as different operating systems require specialized hardware every requires its own system. This paper presents Honeyd, framework for virtual honeypots that simulates computer at the level. The simulated appear to run unallocated addresses. To deceive fingerprinting tools, Honeyd networking stack arbitrary routing topologies services an number systems. discusses Honeyd's design shows how helps in many areas system security, e.g. detecting disabling worms, distracting adversaries, preventing spread spam email.