A Measurement of Real-world Attack Connections toward Honeypots

Honeypot is a special security tool created for enticing attackers and studying their malicious activities. The interaction extent between the honeypot and the attacker is pre-sumably in compliance with the fidelity level (or the interaction level) of the honeypot, i.e., more information system resource the honeypot provides, longer term the attacker is sunk, and more activities the honeypot can capture. However, we found that there are few works focusing on the interaction extent/duration in terms of the attack connection. Therefore, this paper emphasizes the measurement of the time-related property, i.e., the attack connection duration in light of the honeypot's interaction-level. We deploy different interaction-level honeypots on CloudLab to observe the real-world attack connections. The data collection continues for 4 weeks. Thereafter, we apply a statistical analysis on the collected data to verify the correspondence between the attack extend and the honeypot's fidelity level. We figure out that the high-interaction honeypot (HIH) can make the attacker trap in for 6.51 seconds on average, while the low-interaction honeypot (LIH) can hold the attacker in play for just 1.61 seconds on average but can distract more attackers.