# A Comparison of an Adaptive Self-Guarded Honeypot with Conventional Honeypots
## 3 Related Work  
The history of honeypot usage can be traced back to the 1990s, where [PERSON] described a story about a cracker known as [PERSON] that attacked his Internet gateway from a stolen account [16]. [PERSON] had an idea of adding some fake services to a computer that had no production purpose rather just to confuse and jail his uninvited guest. Later, it was only in 2001 that [PERSON] [2] properly defined 'a honeypot is a security resource whose value lies in being probed, attacked, or compromised'. Besides the classification of honeypots by their level of interactivity as described in the Introduction (cf. Section 1), honeypots can also be classified by their purpose, their design or their distribution. Cowrie [9] is an open-source project that is maintained by [PERSON], its code is based on the system called Kippo [17], and they both are written in Python. Cowrie can simulate SSH and Telnet servers and can be configured to simulate different versions of Linux distributions. Cowrie accepts an authentication mechanism via a password file, in which we can define a password for a username or a wildcard for any passwords and/or usernames. One of the remarkable features of Cowrie is that it offers an almost indistinguishable interactive bash shell from the real Linux bash shell that allows the attacker to execute some Linux commands. Once authenticated, the attacker can explore the Linux file system by listing its directory, viewing files, and performing other file system-related commands, such as cp, mv, rm, and if they want to change the password of the compromised account, they can run the command passwd interactively. Furthermore, the attacker can also view the hardware configuration by running the command uname, check its uptime, examine its network configuration via ifconfig, see how many other users are currently online, read all the running processes and download files from the Internet by using the commands wget or curl. However, Cowrie can be easily detected, [PERSON] et al. [18] showed in their detection models, despite invalid commands input, Cowrie always returns zero as an exit status. [PERSON] et al. [19] also demonstrated that it can be fingerprinted at the transport layer, while [PERSON] et al. used a signature-based detection to identify Cowrie [20]. [PERSON] et al. [21] was the first to introduce the adaptive honeypot that used reinforcement learning [7] to dynamically change its behaviour to engage with the attackers. They developed a honeypot called Heliza [22], which is a modified and vulnerable Linux server that can intercept system calls to control the execution of Linux commands. After the attacker broke into the system through the SSH service, they could request to execute a command, Heliza could decide whether the command should be to execute or _blocked_ by returning a message of 'command not found'; it could also choose to _substitute_ it by returning a predetermined result. Another action is _insult_, it is used to learn the identity of the intruder. To drive this decision-making process, Heliza used a reinforcement learning algorithm called SARSA, a model-free and on-policy method [7] similar to Q-learning, to find its strategy to achieve its objective. Heliza can be set to fulfil one of these two objectives: (1) to collect the attacker's tools, or (2) to waste the attacker's time. Each objective has its own reward function in which only the environment state, which is the Linux, commands was used. The authors showed that to achieve the first objective, the command wget, sudo and the newly downloaded programs should be allowed. For the second objective, the commands wget and tar should be substituted with an error message, and the command sudo should be blocked. Inspired by Heliza, [PERSON] et al. developed RASSH [23] and QRASSH [24], but they replaced the Linux system with Kippo [17] and later with Cowrie [9], its successor. In addition to the four actions of Heliza, a new action, _delay_, was added to slow down command executions.