HoneydV6: A low-interaction IPv6 honeypot

This paper starts with the presentation of results from an IPv6-darknet experiment that we conducted during summer 2012. The experiment indicates that attackers are gaining interest in IPv6 networks and appropriate security tools need to be readied. Therefore, we propose HoneydV6, a low-interaction IPv6 honeypot that can simulate entire IPv6 networks and which may be utilized to detect and analyze IPv6 network attacks. Our implementation extends the well-known low-interaction honeypot Honeyd. To the best of our knowledge, this is the first low-interaction honeypot which is able to simulate entire IPv6 networks on a single host. The huge IPv6 address spaces requires new approaches and concepts in order to enable attackers to find and exploit a honeypot. We increase the chance for an attacker to find a target host in our IPv6 honeypot by reacting to the attacker's requests with the dynamic generation of new IPv6 host instances in the honeynet.