Estimating Application Cyberthreat Impact Score for Honeypot Coverage Prioritization

Abstract

Honeypots are one of the important mechanisms in cybersecurity; they represent resources that appear interesting to attackers - either computing resources or data - but are deployed with the sole purpose of studying the techniques and tools of the attackers themselves. As such they are an invaluable resource for detecting the attacks, tools, and for protecting the systems, and many novel domains of application exist. In this paper we present a metric for evaluating the attractiveness of new types of honeypots, that aims to strike a balance between attractiveness of the honeypot for attackers and the real-world popularity of the mimicked system, which is reflected in the usefulness of the collected data. The score is based on the vulnerability density, breach cost, effectiveness of countermeasures, the compliance index, and the size of the real-world install base of the application. A practical calculation is presented based on the proposed formula.