# A Game-Theoretic Analysis for Distributed Honeypots
## 2 Related Work
### Honeypot in Network Security  
The honeypot has been widely used in network for system protection. It can be applied to some fields, such as unmanned aerial vehicles and cloud computing. It functions for detecting malware, identifying illegal traffic, learning behavior of an intruder, tracking an attack, etc..  
With a fuzzy approach, a spoofing attack detection mechanism is proposed in [13]. The low-interaction honeypot called KFSensor gathers the experimental data for analysis. A micro-honeypot is presented to track a web attack using browser fingerprinting technology [14]. Any attackers' identification information will be recorded by the honeypot. Even if these attackers hide themselves, the honeypot can still track them and collect their local IPs (internet protocol addresses). In [15], a low-interaction honeypot and a darknet are correlated by the observed attack time. The scheme can be used to detect scanning attack activities and to estimate the corresponding scale, in which the honeypot records payload data in TCP (transmission control protocol) stream. Besides, the honeypot only responds to TCP SYN (synchronize sequence numbers) and ICMP (internet control messages protocol) echo packets. A medium-interaction honeypot called HoneyDrone is proposed for protecting UAVs (Unmanned Aerial Vehicles) [16]. It emulates some UAV-related protocols to lure an attacker into launching an attack. A new threat intelligence model is proposed in [17]. a honeypot is deployed in a cloud to obtain attack logging. The obtained data are examined to explore the attack pattern in an internet event.  
A deep Q-Learning algorithm is involved in an SSH self-adaptive honeypot system [18], further guiding the honeypot named Cowrie to interact with adversaries. Cowrie is modified to be capable to learn the behavior of an intruder. In [19], a dynamic extensible two-way honeypot is introduced into, which allows incoming and outgoing traffic. The outgoing traffic is held when it contains malicious shellcode and the shellcode is copied and replaced. The mechanism monitors how an intruder interacts with a victim host. Based on machine learning technology, a dynamic honeypot is presented for threat intelligence in a context-aware way [20]. The honeypot is featured with intelligence in deployment with no preset configuration. At the beginning of defense, the honeypot in [21] detects and tags attack flows. The autonomous dynamic honeypot routing is proposed for the identified illegal traffic. Mixture of server nodes and honeypots in DMZ (demilitarized zone) safeguard the network. An adaptive honeypot is integrated with dynamic taint analysis technology [22]. By capturing the commands issued by an intruder, it can detect rootkits. Monitoring sensors and Dionaea-based honeypots constitute a dynamic honeynet system [23]. According to an intruder's behavior, the honeynet reacts flexibly. Detection efficiency is improved via dynamic configuration and the system is efficient in identifying attackers. The framework mentioned in [24] uses honeypots to generate several interesting points for attackers, further detecting zero-day vulnerabilities and some other attack technologies.