Sixth Framework Programme Structuring the European Research Area Specific Programme Research Infrastructures Action

Traditional honeypots listen to unused IP address space waiting for attackers to contact them. Shadow honeypots present another perspective; they demonstrate how honeypots can be coupled with production systems to enhance their security. Based on the observation that attack traffic is considerably less than normal traffic, shadow honeypots propose to use an anomaly detection system (ADS) as a first-pass filter and high-interaction honeypots for verifying the traffic marked by the ADS as suspicious. In this document, we present the design and implementation of a shadow honeypot tailored to protect web servers. We measure its performance in terms of how many requests it can serve and the imposed overhead for various settings and conditions. Finally, we present how we can overcome the current limitations of our design, we discuss issues regarding a generic shadow honeypot architecture and propose future steps to improve our approach.