Weems: An extensible HTTP honeypot

Abstract

Malicious entities are constantly trying their luck at exploiting known vulnerabilities in web services, in an attempt to gain access to resources unauthorized access to resources. For this reason security specialists deploy various network defenses with the goal preventing these threats; one such tool used are web based honeypots. Historically a honeypot will be deployed facing the Internet to masquerade as a live system with the intention of attracting attackers away from the valuable data. Researchers adapted these honeypots and turned them into a platform to allow for the studying and understanding of web attacks and threats on the Internet. Having the ability to develop a honeypot to replicate a specific service meant researchers can now study the behavior patterns of threats, thus giving a better understanding of how to defend against them. This paper discusses a high-level design and implementation of Weems, a low-interaction web based modular HTTP honeypot system. It also presents results obtained from various deployments over a period of time and what can be interpreted from these results.