Definition[]
High-interaction honeypots use a Microsoft operating system as a virtual operating system, which is actually infected. The system is reset at regular intervals and various types of malware, such as the entire bot program that is downloaded after infection can be captured. They record the times, communication protocols, source IP, source port, destination IP, destination port, file sizes, SHA-1 hash, file names, and directory names. They can also identify the users of the attacking bot-infested PCs.[1]
References[]
- ↑ The Fight Against the Threat from Botnets, at 11 n.2.