Agent-based optimization of emulations of network server applications in honeypots

Abstract

Low-interaction honeypots can provide a cost-effective security mechanism for a wide range of computer systems. A central challenge in the development of low-interaction honeypots is the development of emulation programs that mimic the action of server applications on the target platform. The emulation programs must be of high enough fidelity to fool attackers. However, the manual development of these emulations is extremely time-consuming. This paper describes an agent-based optimization system that can automate the generation of emulation programs for honeypots. The system is evaluated in its ability to emulate a mail server. In this evaluation, the system produced correct responses to more than 99% of test data queries.