The Individual Whitepaper series is a collection of publications or presentations about honeypot technologies by the individual members of the Honeynet Research Alliance and the Honeynet Project. These are the respective property of the authors, they were not part of our official review process. We hope that this series can become a valuable resource for honeypot related research. Papers are categorized by

• Academic or Scientific Papers
• Online Articles or Whitepapers
• Conference Presentations

Papers are listed in decending order by date. In other words, the newest papers will be on top of the list. In some cases, the papers are not in English, but the author's native language.

Last Updated: 27 August, 2006

Academic or Scientific Papers

2006

• Honeynet Learning Applying problem and case-based approach in IT security education through the use of honeynets. It's scheduled for publication in the ACM InRoads journal in June 2006. [Phillipine Honeynet Project].
• Effektives Sammeln von Malware mit Honeypots Thorsten Holz, Georg Wicherski, 2006. Proceedings of 13th DFN-CERT Workshop, Hamburg [German Honeynet Project]
• Learning More About Attack Patterns With Honeypots Thorsten Holz, 2006. Lecture Notes in Informatics Proceedings of Sicherheit 2006 [German Honeynet Project]

2005

• Spying With the Help of Bots Thorsten Holz, 2005. ;login: by USENIX, volume 30, number 6" [German Honeynet Project]
• A Short Visit to the Bot Zoo Thorsten Holz, 2005. IEEE Security and Privacy [German Honeynet Project]
• On the Limits of Deception Maximillian Dornseif, Thorsten Holz 2005. LNI [German Honeynet Project]
• Conceptual Framework for a Honeypot Solution Christian Doring, Heinz-Erich Erbs. September, 2005, Ulyanovsk State Technical University [German Honeynet Project].
• Improving Network Security With Honeypots Christian Doring. July, 2005. Thesis. [German Honeyent Project]
• A Pointillist Approach for Comparing Honeypots, F. Pouget, T. Holz, to Appear in Proc. Of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment. (DIMVA 2005), Vienna, Austria, July 2005. [French & German Honeynet Project]
• Flow Based Observations from NETI@home and Honeynet Data, Julian Grizzard, Charles R. Simpson, Jr. Sven Krasser, Henry L. Owen, and George F. Riley, to appear in Proc. 6th IEEE Information Assurance Workshop. [GA Tech Honeynet Project]
• Detecting Honeypots and Other Suspicious Environments Thorsten Holz and Frederic Raynal, to appear in Proc. 6th IEEE Information Assurance Workshop [French & German Honeynet Project]
• Real-Time and Forensic Network Data Analysis Using Animated and Coordinated Visualization, Sven Krasser, Gregory Conti, Julian Grizzard, Jeff Gribschaw, and Henry Owen, to appear in Proc. 6th IEEE Information Assurance Workshop. [GA Tech Honeynet Project]
• Towards a Third Generation Data Capture Architecture for Honeynets, Edward Balas and Camilo Viecco, to appear in Proc. 6th IEEE Information Assurance Workshop. [The Honeynet Project]
• Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks Felix C. Freiling, Thorsten Holz, Georg Wicherski, Technical Report, AIB 2005-07 [German Honeynet Project]
• The use of honeynets to increase computer network security and user awareness, Sven Krasser, Julian Grizzard, Henry Owen, and John Levine, in Journal of Security Education, pp. 23-37, vol. 1, no. 2/3. March 2005 [GA Tech Honeynet Project]
• Leurre.Com: On the Advantages of Deploying a Large Scale Distributed Honeypot Platform, F. Pouget, M. Dacier, V.H. Pham, Proc. Of the E-Crime and Computer Conference 2005 (ECCE'05), Monaco, March 2005. [French Honeynet Project]
• Planung und Realisierung eines Honeynet zur Analyse realer Angriffe aus dem Internet, University of Applied Sciences Aachen, Sven Mueller, February 2005 [German Honeynet Project]

2004

• Towards a better Understanding of Internet Threats to Enhance Survivability, F. Pouget, M. Dacier, V.H. Pham, Proc. Of the International Infrastructure Survivability Workshop 2004. (IISW'04), Lisbonne, Portugal, Dec 2004. [French Honeynet Project]
• Using Honeynets to Protect Large Enterprise Networks, John G. Levine, Julian B. Grizzard, and Henry L. Owen, in IEEE Security & Privacy, November/December 2004, pp. 73-75, vol. 2, no. 6. [GA Tech Honeynet Project]
• Tecnicas de Ocultacao de Trafego de Rede em Honeypots de Alta Interatividade, Luiz Gustavo C. Barbato e Antonio Montes, Anais do VI Simposio sobre Seguranca em Informatica (SSI'2004), (Sao Jose dos Campos, SP), Novembro de 2004. [Brazilian Honeynet Project]
• Measuring Security Threats with Honeypot Technology Maximillian Dornseif, Thorsten Holz, Juliane Mathes, Ingo Weisemoller: Poster session of SANE, October 2004, Amsterdam, The Netherlands [German Honeynet Project]
• Passive Visual Fingerprinting of Network Attack Tools G. Conti and K. Abdullah; ACM Conference on Computer and Communications Security's Workshop on Visualization and Data Mining for Computer Security (VizSEC); October 2004. [GA Tech Honeynet Project]
• HoneyStat: Local Worm Detection Using Honeypots, David Dagon, Xinzhou Qin, Guofei Gu, Wenke Lee, Julian Grizzard, John Levine, and Henry Owen, in Proc. Seventh International Symposium on Recent Advances in Intrusion Detection, Sophia Antipolis, France, September 2004. [GA Tech Honeynet Project]
• Planung und Aufbau eines virtuellen Honeynetzwerkes Diloma thesis, University of Applied Sciences Brandenburg, Sebastian Reitenbach, Aug, 2004 [German Honeynet Project]
• Ermittlung von Verwundbarkeiten mit elektronischen Kodern Proceeding of the `Detection of Intrusions and Malware & Vulnerability Assessment Maximillian Dornseif and Felix C. Gartner and Thorsten Holz, (DIMVA 2004)' Conference, Dortmund, 6-7 Jul 2004 [German Honeynet Project]
• Honeypots e Honeynets: Contra-inteligencia no Ciberespaco, Antonio Montes, Workshop de Seguranca da Informacao DT-ABIN/CPqD, Brasilia, Junho de 2004. [Brazilian Honeynet Project]
• An Investigation of a Compromised Host on a Honeynet Being Used to Increase the Security of a Large Enterprise Network, Timothy R. Jackson, John G. Levine, Julian B. Grizzard, and Henry L. Owen, 5th Annual Information Assurance Workshop, pp. 9-15, West Point, NY, June 2004. [GA Tech Honeynet Project]
• Application of a Methodology to Characterize Rootkits Retrieved from Honeynets, John Levine, Julian Grizzard, and Henry Owen, 5th IEEE Systems, Man and Cybernetics Information Assurance Workshop, pp. 15-21, West Point, New York, June 2004. [GA Tech Honeynet Project]
• Honeypot-Based Forensics, F. Pouget, M. Dacier, Proc. Of AusCERT Asia Pacific Information technology Security Conference 2004. (AusCERT2004), Brisbane, Australia, May 2004. [French Honeynet Project]
• "Modelling the costs and benefits of Honeynets", Proceedings of the 3th Annual Workshop on Economics and Information Security (WEIS04), Maximillian Dornseif and Sascha May, 2004 [German Honeynet Project]
• SMaRT: Resultados da Monitoracao de Atividades Hostis em uma Maquina Preparada para ser Comprometida, Luiz Gustavo C. Barbato e Antonio Montes, I WorkComp Sul - Unisul - Universidade do Sul de Santa Catarina, Florianopolis, Maio de 2004. [Brazilian Honeyent Project]
• Procedimentos e Ferramentas para Manutencao de Honeypots de Alta Interatividade, Lucio Henrique Franco e Antonio Montes, I WorkComp Sul - Unisul - Universidade do Sul de Santa Catarina, Florianopolis, Maio de 2004. [Brazilian Honeyent Project]
• Uso de Honeypots de Baixa Interatividade na Resposta a Incidentes de Seguranca, NIC BR Security Office -- Brazilian Computer Emergency Response Team, Reuniao do GTS (Grupo de Trabalho de Seguranca do Comite Gestor da Internet), Sao Paulo, 20 de abril de 2004. [Brazilian Honeyent Project]
• Honeypots, a Practical Mean to Validate Malicious Fault Assumptions, M. Dacier, F. Pouget, H. Debar, Proc. Of the 10th Pacific Ream Dependable Computing Conference (PRDC04), Tahiti, February 2004. [French Honeynet Project]
• NoSEBrEaK - Attacking Honeynets, Proceedings of the 5th Annual IEEE Information Assurance Workshop, Maximillian Dornseif and Thorsten Holz and Christian N. Klein, 2004 [German Honeynet Project]

2003

• SMaRT - Session Monitoring and Replay Tool, Luiz Gustavo C. Barbato e Antonio Montes, Reuniao do GTS (Grupo de Trabalho de Seguranca do Comite Gestor da Internet), Rio de Janeiro, Dezembro de 2003. [Brazilian Honeyent Project]
• Desvio de Trafego Malicioso Destinado a Redes de Producao para uma Honeynet, Lucio Henrique Franco e Antonio Montes, Reuniao do GTS (Grupo de Trabalho de Seguranca do Comite Gestor da Internet), Rio de Janeiro, Dezembro de 2003. [Brazilian Honeyent Project]
• Mecanismos para Contencao de Trafego Malicioso de Saida em Honeynets, Klaus Steding-Jessen, Cristine Hoepers e Antonio Montes, Anais do V Simposio sobre Seguranca em Informatica (SSI'2003), (Sao Jose dos Campos, SP), Novembro de 2003. [Brazilian Honeyent Project]
• Tecnicas de Monitoracao de Atividades em Honeypots de Alta Interatividade, Luiz Gustavo C. Barbato e Antonio Montes, Anais do V Simposio sobre Seguranca em Informitica (SSI'2003), (Sao Jose dos Campos, SP), Novembro de 2003. [Brazilian Honeyent Project]
• Honeynets Applied to the CSIRT Scenario, Cristine Hoepers, Klaus Steding-Jessen and Antonio Montes, presented at 15th Annual Computer Security Incident Handling Conference, (Ottawa, Canada), June, 2003. [Brazilian Honeyent Project]
• The Use of Honeynets to Detect Exploited Systems Across Large Enterprise Networks, John Levine, Richard LaBella, Henry Owen, Didier Contis, and Brian Culver, in Proc. IEEE 4th Annual Information Assurance Workshop, West Point, NY, June 2003. [GA Tech Honeynet Project]

Online Articles or Whitepapers

2006

• Sebek 3: tracking the attackers, part one Raul Siles, SecurityFocus - Infocus, January 2006 [Spanish Honeynet Project]
• Sebek 3: tracking the attackers, part two Raul Siles, SecurityFocus - Infocus, February 2006 [Spanish Honeynet Project]
• Medium Interaction Honeypots, George Wicherski, April 2006. [German Honeynet Project]

2005

• Sammeln von Malware in nicht nativer Umgebung, Georg Wicherski, 2005 [German Honeynet Project]
• Defeating Honeypots: System Issues, Part 1 Thorsten Holz and Frederic Raynal, SecurityFocus - Infocus, March 2005: [French and German Honeynet Project]
• Defeating Honeypots: System Issues, Part 2 Thorsten Holz and Frederic Raynal, SecurityFocus - Infocus, March 2005: [French and German Honeynet Project]

2004

• Virtual Honeynet: Deploying Honeywall using VMware Faiz Ahmad Shuja, November 2004 [Pakistan Honeynet Project]
• Defeating Honeypots: Network Issues, Part 2 Laurent Oudot and Thorsten Holz SecurityFocus, Oct 2004 [French and German Honeyent Project]
• Defeating Honeypots: Network Issues, Part 1 Laurent Oudot and Thorsten Holz SecurityFocus, Sept 2004 [French and German Honeyent Project]
• Installing a Virtual Honeywall using VMware Diego González, Sep, 2004 [Spanish Honeynet Project]
• Building a GenII Honeynet Gateway Diego González, Aug, 2004 [Spanish Honeynet Project]
• Honeypots Security Intelligence Anton Chuvakin, Elsevier Network Security, June 2004, [netForensics Honeynet Project]
• Honeynet Faiz Ahmad Shuja, March 2004 [Pakistan Honeynet Project]
• Wireless Honeypot Trickery SecurityFocus, Feb 2004 [French Honeynet Project]
• Problems and Challenges with Honeypots SecurityFocus, Jan 2004 [The Honeynet Project]

2003

• Worm Patterns Observed In the Honeynet Anton Chuvakin, Dec 2003, [netForensics Honeynet Project]
• Honeypots Faiz Ahmad Shuja, December 2003 [Pakistan Honeynet Project]
• Fighting Internet Spammers With Honeypots, Part 2 SecurityFocus, Nov 2003 [French Honeynet Project]
• Fighting Internet Spammers With Honeypots, Part 1 SecurityFocus, Nov 2003 [French Honeynet Project]
• Fighting Internet Worms With Honeypots SecurityFocus, Oct 2003 [French Honeynet Project]
• A Forensic Analysis Faiz Ahmad Shuja, October 2003 [Pakistan Honeynet Project]
• Dynamic Honeypots, SecurityFocus, Sep 2003 [The Honeynet Project]
• Days of the Honeynet: Attacks, Tools, Incidents Anton Chuvakin, Apr 2003, [netForensics Honeynet Project]
• Honeypot Farms, SecurityFocus, Aug 2003 [The Honeynet Project]
• Honeytokens: The Other Honeypot, SecurityFocus July, 2003 [The Honeynet Project]

Conference Presentations

2005

• Utilisation des outils Honeypot pour la detection d'intrusion, Eurosec, March 2005, Paris (FR) [French Honeynet Project]
• Honeynet Research at Georgia Tech, Julian Grizzard, Presentation for the Security Seminar Spring 2005. [GA Tech Honeynet Project]
• The Spanish Honeynet Project, Raul Siles, FIST Conference, Madrid, February 2005. [Spanish Honeynet Project]

2004

• Tracking Hackers: Defeating the Attacks! Pak Con 2004, Faiz Ahmad Shuja, December 2004 [Pakistan Honeynet Project]
• Countering Attack Deception Techniques Pacsec core04, Nov 2004, Tokyo (JP) [French Honeynet Project]
• Digital Active (self) Defense [extended] DefCon 12, Aug 2004, Las Vegas (US) [French Honeynet Project]
• Network Attack Visualization G. Conti; DEFCON 12; August 2004.
• Digital Active (self) Defense Black Hat USA, Jul 2004, Las Vegas (US) [French Honeynet Project]
• Retaliation With Honeypots The 5th HOPE, Jul 2004, New York (US) [French Honeynet Project]
• HoneyWRT, SSTIC, June 2004, Rennes (FR) [French Honeynet Project]
• Honeynets and Honeypots: Companion technology for detection and response, Cristine Hoepers, presented at AusCERT Asia Pacific Information Technology Security Conference 2004, Gold Coast, Australia, May, 2004. [Brazilian Honeyent Project]
• Towards evil honeypots?! When they bite back... Cansecwest core04, Apr 2004, Vancouver (CA) [French Honeynet Project]
• Tutorial: Instalacao e Uso de Honeypot de Baixa Interatividade, Lucio Henrique Franco, Luiz Gustavo C. Barbato e Antonio Montes, Reuniao do GTS (Grupo de Trabalho de Seguranca do Comite Gestor da Internet), Sao Paulo, 18 de abril de 2004. [Brazilian Honeyent Project]
• Honeypots Farms, Eurosec, March 2004, Paris (FR) [French Honeynet Project]

2003

• Honeypots Against Worms 101 Black Hat ASIA, Dec 2003, Singapore (SG) [French Honeynet Project]
• Honeypots Distribuidos, Antonio Montes, Klaus Steding-Jessen, Cristine Hoepers, Reuniao do GTS (Grupo de Trabalho de Seguranca do Comite Gestor da Internet), Rio de Janeiro, Dezembro de 2003. [Brazilian Honeyent Project]
• Honey, I Shrunk the Black Hats Institute of Internal Auditors UK, Dec 2003 [French Honeynet Project]
• Microcurso: Honeypots e Honeynets, Antonio Montes, Cristine Hoepers e Klaus Steding-Jessen, Tutorial apresentado no V Simposio sobre Seguranca em Informatica (SSI'2003), (Sao Jose dos Campos, SP), Novembro de 2003. [Brazilian Honeyent Project]