Enabling an Anatomic View to Investigate Honeypot Systems: A Survey

Wenjun Fan, Zhihui Du, David Fernandez, Victor A. Villagra

Research output: Contribution to journalArticlepeer-review

58 Citations (Scopus)


A honeypot is a type of security facility deliberately created to be probed, attacked, and compromised. It is often used for protecting production systems by detecting and deflecting unauthorized accesses. It is also useful for investigating the behavior of attackers, and in particular, unknown attacks. For the past 17 years plenty of effort has been invested in the research and development of honeypot techniques, and they have evolved to be an increasingly powerful means of defending against the creations of the blackhat community. In this paper, by studying a wide set of honeypots, the two essential elements of honeypots - the decoy and the captor - are captured and presented, together with two abstract organizational forms - independent and cooperative - where these two elements can be integrated. A novel decoy and captor (D-C) based taxonomy is proposed for the purpose of studying and classifying the various honeypot techniques. An extensive set of independent and cooperative honeypot projects and research that cover these techniques is surveyed under the taxonomy framework. Furthermore, two subsets of features from the taxonomy are identified, which can greatly influence the honeypot performances. These two subsets of features are applied to a number of typical independent and cooperative honeypots separately in order to validate the taxonomy and predict the honeypot development trends.

Original languageEnglish
Article number8098608
Pages (from-to)3906-3919
Number of pages14
JournalIEEE Systems Journal
Issue number4
Publication statusPublished - Dec 2018
Externally publishedYes


  • Computer security
  • honeypots
  • intrusion detection
  • network security
  • virtualization

Cite this