3.8. Summary

This chapter provided an introduction to low-interaction honeypots. The main characteristics of low-interaction honeypots are that the systems are only simulated and do not support complete compromises of a computer system. On the other hand, they usually offer higher performance and are easier to deploy. We presented several toolkits of creating such low-interaction honeypots. LaBrea and Tiny Honeypot operate at the network layer, whereas the Google Hack Honeypot and PHP.HoP operate the application layer of a web server. We also discussed how to secure your low-interaction honeypots so that an adversary cannot wreak havoc on your system.