7.4. Research Summary

We have given an overview of three research systems that help improve the performance of honeypot installations by combining techniques from low-interaction honeypots with high-interaction honeypots. Although, these systems are not available as open source projects, they provide valuable insights into designing your own more sophisticated honeynets. The Collapsar system showed the replication and central management can achieve a highly scalable system. Potemkin, on the other hand, realized that most high-interaction honeypots make poor use of their resources because they are idle most of the time. Potemkin can create and destroy high-interaction honeypots on the fly, resulting in much better resource utilization. Finally, with RolePlayer, it is possible to reply to well-known attacks without requiring any involvement of a high-interaction honeypot. Instead, the high-interaction honeypots can be used specificaly for novel traffic that has not yet been observed. For interested researchers, it may be possible to get access to these systems by contacting the respective authors.