Contractual Date of Delivery M

This document provides an overview of all NoAH components, defines their requirements and describes the interface between them. The NoAH architecture, as described so far, is a set of individual components that cooperate to form a farm of distributed honeypots. Although the main NoAH components –low-and high-interaction honeypots, signature generation, honey@home and funneling/tunneling – can work individually, they need a well-defined interface between them in order to cooperate. In this deliverable we set the interfaces between honey@home and the NoAH core, low-interaction honeypots with high-interaction ones and finally high-interaction honeypots with signature generation mechanisms. Furthermore, besides the traffic and detection components, a complete architecture requires a database that will store meta-data about honeypot status, data collected and operational roles. We describe the design of the database also in this document.