A Dynamic Approach for Honeypot Management

Honeypot is a security device the value of which lies mainly in discovering and inspecting, being attacked and being at risk. Most of the present honeypots are configured and installed on the network statically. In some cases, considerations have been made on dynamic configuration of honeypots at the time of installation. However, no study has been carried out on how to instantaneously change the configuration of honeypots based upon the analysis of the collected events from various network elements including routers, firewalls, spam identifiers and honeypots. In this paper, we propose a method that the honeynet is automatically configured so that the conditions are prepared for trapping the threats based on the reports sent from several elements of the network and also the defined rules of the system. Unlike the other methods which wait until the threat reaches the honeypot, the main idea in the proposed method is to configure it to move to attract the attacks. The present scheme has been evaluated in a real environment. The results of the evaluation, illustrated the efficiency of the suggested method.