A honeypot is a computer security mechanism designed to detect unauthorized access. It acts as a trap for attackers by diverting their attention from real network resources. The main functions of a honeypot are to build attacker profiles, identify preferred attack methods, and capture new viruses. Honeypots are classified by their level of interaction (low interaction provides emulated services while high interaction uses actual operating systems), implementation (physical vs virtual), and purpose (research to discover new attacks vs production to detect threats).

1. Honeypot
-presented by
1.Syeda Khadizatul Maria
ID: 161-15-7333
1.Shahrun Siddique Taki
ID: 161-15-7195

2. What is Honeypot?
A honeypot is a computer security mechanism set to detect, deflect
or counteract attempts at unauthorized use of information system.
It’s simply a TRAP to attacker.
Main Functions of Honeypot :
• To divert the attention of the attacker from the real network,
in a way that the main information resources are not compromised
• To build attacker profiles in order to identify their preferred
attack methods, like criminal profile.
• To capture new viruses or worms for future study.

3. HISTORY
• The idea of honeypots began with two publications, “ The
cuckoos egg” & “ An evening with Bredford ” .
• “ The cuckoos egg “ was about catching a computer hacker
that was searching for secrets in authors corporation.
• “ An evening with Berdferd” is about a hackers moves
through traps that the author used to catch him

4. Classification:
By
Implementation
By
purpose
High Low
Physical
Production
Virtual
Research
By level of
Interaction

5. Level of Interaction:
1. Low Interaction:
- Provide emulated services
- No operating system to access
- Information limited to transactional information and attackers activities with the
emulated services
2. High Interaction:
- Provides actual Operating Systems
- Learn extensive amount of information
- Extensive risk

6. Level of Interaction:
1. Low Interaction:
- Provide emulated services
- No operating system to access
- Information limited to transactional information and attackers activities with the
emulated services
2. High Interaction:
- Provides actual Operating Systems
- Learn extensive amount of information
- Extensive risk

7. Implementation:
1. Physical:
- Real machine
- Own IP Addresses
- Often high-interactive
2. Virtual:
- Simulated by other machines that:
- Respond to the network traffic sent to the honeypots
-May simulate a lot of (different) virtual honeypots at the same time

8. Purpose:
1. Research :
- Discover new attacks
- Understand the black hat community and their attacks
- Build some better defenses against security threats
2. Production:
- Distraction
- Detect internal threats: “Policy/Law Enforcement”
- Security Assessment (Constantly monitors the average
security provided by the network)

9. Thank you
• “If you know the enemy and know yourself, you
need not fear the result of a hundred battles. If you
know yourself but not the enemy, for every victory
gained you will also suffer a defeat. If you know
neither the enemy nor yourself, you will succumb in
every battle.”
•
― Sun Tzu, The Art of War