Efficacy Measuring Framework for the Assessment of Dynamic Honeypot

Abstract

Honeypots are the form of decoys deployed in the network to capture malicious and unauthorized activities, they are also used to observe adversary behavior, tools, and strategies in a variety of ways. However, the effectiveness of the honeypot is only determined when it is breached by the intruder. Unfortunately, implementing and maintaining honeypots is difficult and it is also hard to measure the efficacy that compounds the problems after implementation. There is a need for some processes to determine if honeypot is efficient while it is kept active round-the-clock. This is an active issue since an ineffective honeypot could result in poor efficiency, misrepresentation, or even premature detection by an attacker. As a result, a detailed and in-depth analysis framework for honeypot efficacy has been proposed in this paper, which has hitherto not appeared in much literature, and reveals several important limitations of active honeypot for the organization when it is not required. The objective is to determine the decision matrix to assess honeypot's ability to fingerprint, obtain valid adversary data, deceive intruders, and smartly monitor the network environment at an optimum cost.