A Comparison of Record and Play Honeypot Designs

Abstract

Record and play -honeypots mimic normal TCP traffic and fool the adversary with fake data while simultaneously keeping the setting realistic. ln this paper, we propose several designs for such honeypots. Two important aspects of honeypot design are considered. First, we compare named entity recognition systems in order to recognize the entities in the messages the honeypot modifies. Second, we consider methods to fake these entities consistently. Pros and cons of each approach -- varying from the better accuracy of the fake responses to the possibility of causing side effects on the real services -- are discussed.