Automatic Creation of Low-Interaction Honeypots for Stateless Network Protocols

Abstract

Low-interaction honeypots are always a compromise between having good interactivity and being cheap to create and run. Tools exist to automatically create low-interaction honeypots, but they achieve their great usability at the cost of interactivity, limiting their usefulness. We introduce a way of achieving better interactivity while maintaining the same level of usability, which operates at a lower level and is flexible enough to be used with other protocols besides HTTP(S). We implement a tool called SyrupPot to create copies of existing HTTP(S) services automatically, which then server as honeypots. These honeypots can handle more situations than existing approaches and are easily adapted to new requirements. To demonstrate their usefulness we create honeypots from IoT devices and evaluate their quality.

Publication
TU Wien