Paper2004
Material reviewed: AbstractThis paper provides an introduction to honeypots (electronic bait), network resources designed to be attacked and compromised, indistinguishable from regular systems. According to the authors, these systems can be interconnected into honeynets equipped with special software facilitating forensic analysis of incidents. The work describes the setup and first experiences of such a network deployed at RWTH Aachen University, aiming to learn about attacker behavior in networks.
NetworkHoneypot
Paper2004
Material reviewed: AbstractThe paper describes a system for generating attack signatures for network intrusion detection systems, applying pattern-matching techniques and protocol conformance checks at multiple levels of the protocol hierarchy to network traffic captured at a honeypot system. The authors report results from running the system for 24 hours on an unprotected cable modem connection, where it created precise traffic signatures.
NetworkHoneypot
Paper2004
Material reviewed: AbstractThis paper proposes a model for estimating the costs and benefits associated with deploying honeynet technology, an area where, according to the authors, a clear framework for optimal security resource allocation was lacking. The stated goal is to foster informed reasoning about the adoption of honeynets as an IT security measure.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingLow-interaction honeypot simulating the Android Debug Bridge service.
IoTHoneypot
Open software—
Material reviewed: Repository documentationDocumented honeypot for CVE-2017-5689: a web server listens on TCP port 16922 and imitates the Intel AMT management service. If exploited, it serves the attacker content obtained from an HP machine.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationAmun is a Python-based low-interaction honeypot, described as the first of its kind, following Nepenthes' concepts while extending emulation. Per its documentation, it logs exploitation attempts, malware downloads, and unknown shellcode across separate log files.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA user-friendly, CISO-friendly configuration, management and acquisition tool for honeyd that provides a usable interface for configuring, deploying honeypots and receiving their logs from a central server.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDescribed as a low-interaction honeypot; the source does not specify its environment or features.
Honeypot
Open software—
Material reviewed: Repository documentationArgos is an advertised honeypot using dynamic taint analysis to detect and analyze control flow attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationTool combining a honeypot on commonly attacked ports with monitoring and alerts; according to the documentation, it blacklists IPs that connect to those ports.
NetworkHoneypot
Community or education—
Material reviewed: Public pageCommunity list of honeypot projects and materials; each link requires separate verification.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationWeb honeypot that responds to HEAD and GET requests with an HTTP Basic challenge and logs received credentials; it accepts no username or password.
ApplicationIdentityHoneypot
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationA tool that parses logs from multiple honeypots (Kippo/Cowrie SSH, phpMyAdmin, Wordpot, Redispot, VncLowPot, Pghoney) to extract malicious IPs, URLs, and file hashes and publish them as pulses in AlienVault OTX.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA high-interaction HTTP/HTTPS honeypot that presents vulnerable web applications to observe attacker access. The documentation says it sends logs to BigQuery and saves packet captures.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationOpen-source tool that scans systems to detect misconfigurations or fingerprints revealing honeypots, helping researchers make them harder to detect.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingSSH and Telnet honeypot that records login attempts and attacker sessions.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationAn academic project that deploys a honeypot alongside an Elastic stack (Elasticsearch/Kibana) and ElastAlert, including a custom 'MITREAttack' alert that writes information according to the MITRE ATT&CK matrix for detecting and classifying attacks.
NetworkEndpointHoneypot
Service—
Material reviewed: Public pageHoneypot service offering published by Maple Networks.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDistributed low-interaction honeypot whose agents simulate services with protocol handlers and whose master receives attack information.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingHoneypot project for observing attacks against network services.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA low-interaction honeypot, successor to nepenthes, offering emulated network services such as SMB, HTTP, FTP, TFTP, and MSSQL via embedded Python and libemu, aiming to capture copies of malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea is a low-interaction honeypot, successor to nepenthes, designed to trap malware exploiting vulnerabilities in network services offered to a network, with the goal of obtaining a copy of the malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea-Vagrant is a set of scripts and a Vagrantfile that automate deployment of a virtual machine running the Dionaea malware honeypot on Ubuntu 12.04, installing dependencies and running it as a daemon alongside p0f.
NetworkHoneypot