4 ms·
Honeypot Turing Test
- jwcrux 10y agoIt seems like a decent middle ground between high interaction honeypots and full on vm's would be leveraging something like containers. I've considered doing this before but, you know, if free time grew on trees... The benefit of using containers is that you can blow them away after every session, they have builtin networking so you can make entire honey nets, they're dirt cheap, and sharing the configs is a no brainer.
- mgraczyk 10y agoAlthough the general idea of simulating a protocol for a Honeypot is reasonable, it does not seem like the authors have anything to contribute here. They vaguely hint toward using an LSTM to solve a difficult AI problem. An LSTM's output would be significantly worse than a hand coded solution at simulating a network protocol. They do not provide any data, metrics, or analysis.
- yankoff 10y agoWhy do you think it'd be significantly worse?
- valedra 10y agoIf they want to translate some input to sensible output they would be better off using a translation model that has two LSTMs and a ton of data. See: https://github.com/harvardnlp/seq2seq-attn https://github.com/harvardnlp/seq2seq-attn They are also not giving credit for the graphic they are using: http://colah.github.io/posts/2015-08-Understanding-LSTMs/ http://colah.github.io/posts/2015-08-Understanding-LSTMs/