A Honeypot Detection Method based on Behavior Analysis and Environment Evaluation
Dong Chun-l · Microcomputer Information · 2010
Honeypot is a typical technology of active defense.It can be used to monitor and record the behavior of the attackers.This paper proposes a new model to detect honeypot,and introduces a detection method to detect high-interactive honeypot system which is based on behavior analysis and environment evaluation.First,some attack messages are dispatched from a captured host,and consider the host is a honeypot host if the dispatch is anomaly,second,judge the captured host is running on a real host or a virtual host with its system information and hardware configuration,and consider it is a honeypot if it is running on a virtual host with some service provided.