BAIT-TRAP : a Catering Honeypot Framework

The honeypot has been proved effective in understanding intruders’ tactics and tools which exploit system or software vulnerabilities. However, most current honeypots are manually and statically composed and deployed, leading to the following disadvantages: (1) It only exhibits a small and fixed spatial vulnerability window in terms of number and variety of vulnerable services; (2) It ignores current network activities and can only provide information on threats to deployed services. New vulnerabilities in a service not deployed in the honeypot will remain undetected. To address the limitations, this paper proposes the notion of catering honeypots and presents a catering honeypot architecture called BAIT-TRAP. The catering honeypot is a honeypot architecture that constantly monitors network traffic, identifies “bait” services that are currently attractive to intruders, and dynamically creates honeypots running such services in the hope of quickly trapping the subsequent exploitations. To the best of our knowledge, this is the first proposal and implementation of catering honeypots. Our real-world deployment of BAIT-TRAP has captured a number of “trendy” attack incidents, demonstrating the timeliness and trend awareness of catering honeypots.