A Comparison of Record and Play Honeypot Designs

Abstract

<p>Record and play -honeypots mimic the normal TCP traffic and fool the adversary with fake data<br />while simultaneously keeping the setting realistic. In this paper, we propose several designs for such honeypots.<br />Two important aspects of honeypot design are considered. First, we compare named entity recognition systems<br />in order to recognize the entities in the messages the honeypot modifies. Second, we consider methods to<br />fake these entities consistently. Pros and cons of each approach – varying from the better accuracy of the fake<br />responses to the possibility of causing side effects on the real services – are discussed.<br /></p>