Next-generation honeynet technology with real-time forensics for US defense

High-interaction honeynets are extraordinary intrusion intelligence tools. Unfortunately, their power has come at a significant cost. Forensic analysis can be cumbersome and labor intensive, management burdens are often onerous, and compromised honeynets present a risk of being used to stage further attacks. In short, these high-interaction intelligence tools have lacked operational agility. We present a novel approach to honeypot architecture that combines advances in virtualization, low-level introspection, signature generation, and forensic analysis to construct a real-time, high-interaction intrusion intelligence and prevention tool.