# Optimizing Internet of Things Honeypots with Machine Learning: A Review
## 5 Findings
### Interaction Honeypots  
Honeypots are tools for cyber deception that were initially introduced in the 1990s [4]. In the early 2010s, a literature review by [PERSON] et al. [4] identified numerous advances and trends that had evolved since the 1990s; the same can be said about the last 10+ years. The area of honeypots has made significant advances in the last century. This has been further driven by the emergence of machine learning and artificial intelligence in recent years. However, even though significant strides have been made in the honeypot and cyber deception area, major weaknesses remain present to this day. The key issues identified in the analyzed literature are: The inability to generate network traffic that can mimic real traffic flow, which makes it possible for attackers to distinguish honeypots from real networks based on this characteristic [26]. Traditional honeypots have a static configuration and fixed network location, which becomes invalid in the case that the honeypot is detected or bypassed by the attackers [60]. It can be said that the main problem of traditional honeypots and even high-interaction honeypots is the ease with which attackers can detect them. With the attacker's knowledge of their existence, the value of a honeypots nullifies, as it is possible for them to be bypassed [61]. In general, honeypots can be distinguished into low-interaction and high-interaction honeypots. There are also medium-interaction honeypots; however, these are not as common as the other two types. Therefore, this study will focus on the two most prevalent ones in the literature. Low-interaction honeypots are designed to emulate specific services or protocols, such as Telnet, SSH, or HTTP, which are commonly targeted in IoT environments. These honeypots provide limited interaction with attackers, focusing on detecting and logging attack attempts [13; 35]. Low-interaction honeypots are simple to deploy, making them ideal for large-scale monitoring. Tools like Honeyd and Dionaea have been widely adopted due to their flexibility and low resource requirements [13]. In addition to that, for instance, IoTCmal can emulate a range of devices and protocols by implementing partial TCP/IP stacks, allowing researchers to simulate various IoT environments at scale [66]. Attackers often target common IoT services known for their vulnerabilities. Dionaea, for example, emulates services like FTP, SMB, and Telnet, capturing malware samples and providing valuable insights into the types of attacks that exploit these services. The focus on emulating widely used protocols makes low-interaction honeypots effective for capturing data from automated attacks, such as those launched by botnets like Mirai [47]. Low-interaction honeypots are particularly effective at capturing and detecting large-scale automated attacks. For example, Dionaea has been used extensively to gather malware samples by emulating vulnerable IoT services, which are frequently targeted by automated scanning tools. The malware collected from these honeypots provides researchers with critical data for analyzing attack patterns and understanding the propagation mechanisms used by malware like the Mirai botnet [47]. The data collected by low-interaction honeypots can be integrated into broader threat intelligence systems. For instance, [PERSON] et al. discuss the integration of low-interaction honeypots in a multi-platform threat intelligence framework, where the data from these honeypots are correlated with other sources to enhance the detection of known malware signatures and emerging threats [40]. One of the major drawbacks of low-interaction honeypots is their vulnerability to detection. Skilled attackers can often recognize these honeypots through fingerprinting techniques, as theirsimplified responses and limited protocol implementations reveal their decoy nature [35]. Research by [PERSON] et al.