# A Comparison of an Adaptive Self-Guarded Honeypot with Conventional Honeypots
## 6 Experimental Results  
In this section, we will describe the performance of each system based on the attack data obtained from their real deployment and what we learned from this experiment.  
To evaluate the performance of each system, we use the following criteria:  
* The quantity and the quality of the attack data received: the number of attack episodes, the number of commands, which include the minimum, maximum and average number of commands executed per episode, and the number of attack sequences;
* The number and type of collected files;
* The attacker's behaviour;
* The \(q\)-values, which show how each adaptive honeypot learns its objectives.
* The number of incidents that each system was reported to participate in the attacks;
* The number of human attackers that each system lures into attacking it.  
Before we present our experimental results, first, we will describe how the honeypot systems were set up and deployed and also how some hyperparameters were chosen to train both Asgard and Midgard systems for the experiment.  
In addition to our honeypot systems Asgard and Midgard, we also set up a high-interaction honeypot, which we named Aster, using a plain, standard Linux server behind a proxy system similar to the Asgard's and Midgard's; however, in the Aster case, the proxy system is only used to authenticate users and record all communications. Aster is also vulnerable to the same brute force attack. We deployed each of these three systems, Asgard, Midgard and Aster, using two separate Docker containers: one for the proxy system and one for the OpenSSH server, on three different virtual machines running Linux Debian 10. The OpenSSH server was built from the official Linux Debian 10 docker image. The fourth platform, Cowrie, was also deployed as a Docker container on another virtual machine. We modified its default configuration, such as hostname, OpenSSH version and kernel information, to match that of the host system. To train Asgard and Midgard, these are the values of the hyperparameters that were used: \(\epsilon=0.5\) and its decay rate of 0.99984 for each update of the model--which amounts to 10K updates--until it reaches the minimum value of 0.1, \(\alpha=0.01\) and \(\gamma=0.99\). The systems were deployed for around 100 days from early 11/2021 until early 03/2022 on the public university network. The systems were stopped and restarted sporadically.  
At the initial deployment, the systems were allowed to run at a maximum speed allocated for the virtual machines, but after noticing that our honeypots were frequently compromised and exploited to mine cryptocurrencies, we limited their CPU consumption as well as the network bandwidth. In each attack episode, we recorded the information related to the attack, such as network connection, session number, key exchange algorithms, SSH client version, connection time, username, password, entered commands, TCP/IP Port Forwarding requests [8] and payloads, connection duration and downloaded files. The update of the agent's model is conducted online; that is, its model is being updated and queried at the same time. The update of the model happens after each episode. However, it is also possible that during the same episode, the model is updated multiple times because in the same SSH connection, there can be multiple channels open to request the command executions, which can also be considered as an episode.