Honeypots are fake information resources that authorized users never connect with and which are under permanent control of information security specialists. Honeypots are widely used traps for hackers, which gather features of attacks. Collected features then are accumulated in anti-virus databases which serve as evidences in cyber forensics or as reference samples in machine learning systems. The quality of security tools depends on the ability to gather representative information about actual cyber-attacks.
During the past twenty years, honeypots have evolved from standalone tools emulating one or two network services to systems of many highly interactive traps. Modern honeypots emulate a large scale of services from FTP and SSH to VoIP and industrial systems. They can monitor web-attacks, client-side exploitations, targeted attacks in corporate networks and intruder’s activity. The weakest point occurs when hackers are aware of traps and often avoid honeypots by comparing them to real systems.