How to Design Practical Client Honeypots Based on Virtual Environment

Abstract

Honeypot is known as the most famous and widely deployed tool for collecting malwares on the Internet. Conventional honeypots lure attackers into them by simulating vulnerable applications, programs and services, and are able to collect malwares by monitoring malicious activities of attackers. While client honeypots visit websites linked to URLs which are previously provided by users and collect malwares by analyzing the websites. Since attackers mainly use websites for spreading their well-crafted malwares or compromising their target systems, client honeypots have a remarkable attention for the purpose of collecting malwares effectively. However, most existing approaches focus on only collecting malwares by using open source client honeypots such as Capture-HPC, HoneyClient, HoneyMonkey, etc and analyzing them. In this paper, we present how to design practical client honeypots based on virtual environment. The proposed client honeypots are able to help users who want to develop their own client honeypots and deploy them. The experimental results show that the proposed client honeypots visited 2,276,733 URLs, identified 28,831 malicious URLs and succeeded in collecting 2,115 malwares.