[Paper Review] Gotta catch 'em all: a Multistage Framework for honeypot fingerprinting

Shreyas Srinivasa, Jens Myrup Pedersen+1 more|arXiv (Cornell University)|Sep 22, 2021

Network Security and Intrusion Detection4 citations

TL;DR

This paper presents a multistage, probe-based framework for identifying honeypots across the IPv4 internet using active fingerprinting techniques combined with passive data from third-party scanners. It identifies 21,855 honeypot instances across 2.9 billion IP addresses, demonstrating that probe-based methods detect 100% of honeypots—significantly outperforming third-party meta-scan techniques that only detect 33.9%.

ABSTRACT

Honeypots are decoy systems that lure attackers by presenting them with a seemingly vulnerable system. They provide an early detection mechanism as well as a method for learning how adversaries work and think. However, over the last years, a number of researchers have shown methods for fingerprinting honeypots. This significantly decreases the value of a honeypot; if an attacker is able to recognize the existence of such a system, they can evade it. In this article, we revisit the honeypot identification field, by providing a holistic framework that includes state of the art and novel fingerprinting components. We decrease the probability of false positives by proposing a rigid multi-step approach for labeling a system as a honeypot. We perform extensive scans covering 2.9 billion addresses of the IPv4 space and identify a total of 21,855 honeypot instances. Moreover, we present a number of interesting side-findings such as the identification of more than 354,431 non-honeypot systems that represent potentially vulnerable servers (e.g. SSH servers with default password configurations and vulnerable versions). Lastly, we discuss countermeasures against honeypot fingerprinting techniques.

Motivation & Objective

• To develop a comprehensive, multi-layered framework for detecting honeypots with minimal false positives.
• To evaluate the effectiveness of probe-based fingerprinting techniques compared to passive, third-party meta-scan methods.
• To identify and characterize non-honeypot systems with high-risk configurations, such as default passwords and known vulnerabilities.
• To raise awareness among honeypot developers and administrators about fingerprinting risks and to suggest countermeasures.
• To contribute to the security community by providing a reproducible, large-scale scan of honeypot presence and system exposure on the public internet.

Proposed method

• Design a multistage fingerprinting pipeline combining active probing and passive data analysis to reduce false positives.
• Implement protocol handshake fingerprinting to detect anomalies in service responses across SSH, Telnet, HTTP, FTP, and other common services.
• Introduce a static TLS certificate analysis method to identify honeypots based on non-random or predictable certificate patterns.
• Apply Fully Qualified Domain Name (FQDN) checks to detect inconsistencies indicating honeypot deployment.
• Integrate third-party data from mass-scan providers (e.g., Shodan) to validate and cross-reference results.
• Use a rigid, multi-step decision process to label a system as a honeypot only after passing multiple independent checks.

Experimental results

Research questions

• RQ1 How effective are probe-based fingerprinting techniques in identifying honeypots compared to passive, third-party meta-scan methods?
• RQ2 What is the true scale of honeypot deployment across the public IPv4 space, and how does it vary across different honeypot implementations?
• RQ3 Which fingerprinting techniques are most reliable in minimizing false positives while maintaining high detection accuracy?
• RQ4 What proportion of systems identified as non-honeypots exhibit high-risk configurations such as default passwords or known vulnerabilities?
• RQ5 What practical countermeasures can be implemented to defend honeypots against fingerprinting, especially in the context of evolving malware behavior?

Key findings

• The framework identified 21,855 unique honeypot instances across 2.9 billion IPv4 addresses, with a significantly reduced false positive rate due to the multistage validation process.
• Probe-based fingerprinting techniques detected 100% of the honeypots, whereas third-party meta-scan methods detected only 33.9% of the total honeypot population.
• More than 354,431 non-honeypot systems were identified as potentially vulnerable, including SSH and FTP servers with default passwords or known high-severity vulnerabilities.
• The study confirms that many widely used open-source honeypots remain detectable via simple, reproducible fingerprinting techniques, highlighting ongoing security risks.
• The results demonstrate that existing honeypot detection methods relying on passive data are insufficient, and active probing is essential for comprehensive detection.
• The authors contacted honeypot developers and administrators to raise awareness, though they express low confidence in widespread patching due to the complexity and maintenance burden of such systems.