Honeybrid: combining low and high interaction honeypots

The goal of this post is to introduce myself and my project: my name is Robin Berthier and I just got my PhD from the University of Maryland. I’ll be working this summer on improving Honeybrid, a hybrid honeypot architecture. I’ve been working with honeypot technologies for the past 4 years, and Honeybrid represents a central part of my dissertation. 

Honeypots are usually divided into two categories according to the level of interaction they provide to attackers. First, we have low interaction honeypots that emulates network services and collect the beginning of attack processes. And then we have high interaction honeypots that are identical to production machines and collect detailed information about attacks. These two types of honeypot offer complementary advantages and limitations. The goal of honeybrid is to combine the best of both world. As such, Honeybrid is a hybrid honeypot solution.