The Role of Deception in Securing Our Cyberspace: Honeypots Are a Viable Option

Honeypot Definitions

Honeypots are special systems designed to track and trap attackers and learn their attack methods. They are special in the sense that they are not a solution but rather a general technology that do not solve a specific security problem which is continuously changing, and can be involved in many facets of security such as information gathering, detection, and prevention (Verizon, 2019). Security researchers and administrators often use honeypots to unobtrusively track and monitor what malicious attackers are doing in order to compromise computer resources. A honeypot is a tool designed to learn the attack methods the adversaries use to query and exploit vulnerabilities in a system. So, a honeypot is a security resource whose value lies in being probed, attacked, or compromised (WhiteHatSecurity, 2016).

Several definitions for the term `honeypot' have been proposed, and below we present some of those definitions:

• •

  Definition 1: “a honeypot is a security resource whose value lies in being probed, attacked and compromised” (Spitzner, 2002).

• •

  Definition 2: “a honeypot is a computer which has been configured to some extent to seem normal to an attacker, but actually logs and observes what the attacker does” (Gibbens, 1999).

• •

  Definition 3: “a honeypot is a general computing resource whose sole task is to be probed, attacked, and compromised, used or accessed in any other unauthorized way” (Grudziecki et al., 2012).

For the purpose of this chapter, we adopt definition 1 mainly because rather than being specific to a particular security resource like the rest, the definition describes a honeypot in a more general sense, of which we believe a general term `honeypot' should be defined.