The IT Law Wiki

High-interaction honeypot

32,080pages on
this wiki
Add New Page
Add New Page Talk0

Definition Edit

High-interaction honeypots use a Microsoft operating system as a virtual operating system, which is actually infected. The system is reset at regular intervals and various types of malware, such as the entire bot program that is downloaded after infection can be captured. They record the times, communication protocols, source IP, source port, destination IP, destination port, file sizes, SHA-1 hash, file names, and directory names. They can also identify the users of the attacking bot-infested PCs.[1]

References Edit

  1. The Fight Against the Threat from Botnets, at 11 n.2.

Also on Fandom

Random Wiki