A Survey on Honeypot and Honeynet Systems for Intrusion Detection in Cloud Environment

In this survey, we give an extensive overview on honeypots and presented different architectures and models for honeynet and how new technologies affected these designs, this includes not only honeypot software but also methodologies to analyse honeypot data. Honeynet is network architecture that is meant to deceive an attacker and capture their techniques for further analysis of the attacking session, they have been evolving through the last two decades, but without coping with the continuously advanced adversaries’ techniques. Applying extra security tools and measures to a cloud environment is highly demanded for the sensitive resources and services with high availability that are hosted on the cloud, with that in mind integrating a new security technique may cause a network and performance overhead that might affect the underlined service and thus increase the latency dramatically, this paper presents the different architectures and models for honeynet and how new technologies affected these designs. The survey of existing honeypots was introduced, in addition to highlighting their strength and weakness points. Evolution of attacking techniques, patterns and propagation, giving a comparison between different honeypot projects and the efforts that were contributed through them to this field, moreover the list of different honeypots, services, type of interaction and some beneficial insights of honeypots application for future systems.