# Optimizing Internet of Things Honeypots with Machine Learning: A Review
## 5 Findings
### Interaction Honeypots
highlights that low-interaction honeypots like KFSensor and Honeyd are effective for detecting basic reconnaissance but fail to engage attackers attempting more sophisticated exploits [40]. Also, due to their design, they cannot capture the full scope of an attacker's methods. They are primarily useful for detecting initial scanning and exploitation attempts but provide limited insight into the attacker's behavior one access is gained. These limitations make them less effective for studying complex, multi-stage attacks that require deeper system interaction [40]. High-interaction honeypots offer a deeper level of engagement by emulating real systems or using actual IoT devices. These honeypots can capture detailed data on attacker behavior, providing insights into sophisticated attacks that low-interaction honeypots cannot detect [13]. High-interaction honeypots like FirmPot and HoeyIoT provide realistic environments that closely mimic actual IoT devices, including vulnerable firmware versions. FirmPot, for instance, uses real firmware images of routers and surveillance cameras, allowing researchers to emulate the exact behavior of these devices [69]. This approach makes it difficult for attackers to distinguish the honeypot from a genuine device, increasing the chances of capturing detailed exploitation attempts [66]. HoneyIoT employs reinforcement learning techniques to dynamically adapt its responses based on attacker actions, using a Markov decision process to model and predict attacker behavior. This adaptability reduces the likelihood of detection and provides a more authentic interaction, allowing researchers to observe complex attack techniques and gain a deeper understanding of the tactics used by sophisticated threat actors [35]. However, this study will provide more details regarding reinforcement learning in Section 4.2. On the other side, high-interaction honeypots require significant resources, including powerful hardware, advanced virtualization, or even real devices, to provide realistic interactions. The complexity of deploying and maintaining these honeypots is highlighted in the study by [PERSON] et al., which discussed the need for robust containment measures to prevent the honeypot from being compromised and used for malicious purposes [66]. Because high-interaction honeypots simulate real systems or use actual devices, there is a higher risk that attackers could exploit vulnerabilities in the honeypot itself. This potential for compromise necessitates careful isolation and monitoring, as a compromised honeypot could be leveraged to launch attacks against other system [26]. Therefore, to compare the two types, it is important to understand that the decision on which honeypot to use comes with significant tradeoffs. Low-interaction honeypots excel in scalability and resource efficiency, making them suitable for detecting large-scale, automated attacks. However, their limited interaction capabilities restrict the depth of analysis. High-interaction honeypots provide richer data and deeper insights into attacker behavior but are resource-intensive and challenging to deploy at scale. High-interaction honeypots like FirmPot and HoneyIoT are more resilient against evasion tactics due to their realistic emulation [35,69]. In contrast, low-interaction honeypots are often detected by experienced attackers, reducing their effectiveness for capturing sophisticated threats. In addition to the prior discussed types of honeypots, in recent years, another approach emerged: hybrid honeypot models. They manage to integrate both low-interaction and high-interaction modules that map real device vulnerabilities to the public network. This hybrid approach allows for broad threat detection and detailed analysis, capturing a wide range of attacks from basic scans to complex malware exploits [66]. Also, some hybrid honeypots dynamically adjust their interaction level based on detected threats.