# Optimizing Internet of Things Honeypots with Machine Learning: A Review
## 5 Findings
### Detection Architecture  
As IoT devices have advanced, traditional brute-force login attacks, such as those targeting telnet ports, have become less effective due to measures like random default passwords and the disabling of telnet and SSH services to avoid botnets like Mirai. Attackers now exploit specific vulnerabilities, such as Remote Code Execution (RCE), to inject malicious code and compromise devices. These vulnerabilities often depend on the type, brand, or model of the target device, prompting attackers to perform pre-attack checks for better success rates. Furthermore, analyzing the interaction traces between attackers and real IoT devices provides valuable insights into attacker behaviors and tactics [35]. To better understand why there was a need for different honeypots, it is of utmost importance to understand what the limitations of traditional honeypots are. Traditional honeypots initially had low interaction capabilities. These early versions only simulated basic services and focused on detecting intrusions, but they lacked the ability to sustain complex interactions or collect detailed data about attacker tactics. Indeed, attackers scan networks for vulnerabilities and perform detailed checks on target devices before launching attacks, so low-interaction honeypots often fail to deceive attackers and miss capturing the actual attack [49]. Due to advances in malware, the need for more sophisticated honeypots emerged, including mid- and high-interaction honeypots. The problem is they still often fail to convincingly replicate the intricacies of real devices, which attackers could identify. IoT-specific vulnerabilities are particularly challenging, as attackers often check device-specific characteristics like brand and firmware version. Limited-interaction honeypots fail in these pre-check attack phases, reducing their effectiveness as they struggle to convincingly simulate device-specific characteristics that attackers look for before engaging fully [31]. Initial traditional setups like Cowrie used by HoneyShell could not fully deceive attackers, as initial phases allowed all credentials and did not emulate sophisticated device features. Later improvements added custom user filesystems and device responses to increase authenticity and engagement [61]. These limitations highlight the need for honeypots to enhance their interaction capabilities to effectively convince attackers that they are real devices. The adaptivity of a honeypot refers to its ability to tailor its interactions based on an attacker's behavior, convincingly mimicking an IoT device to avoid detection. Even when the optimal response is unknown, the honeypot leverages the attacker-provided data to select the most suitable reply. Figure 2 illustrates this adaptive process as a feedback loop between the learning automation and a random environment. The honeypot performs actions within the environment, receives feedback based on those actions, and uses this information to refine its responses continually. AIIPot exemplifies this by broadcasting all incoming requests to the IoT device network, ensuring a highly plausible response that maintains the illusion of authenticity [49]. Adaptive honeypots generate responses based on the likelihood of eliciting a reply from the attacker, ensuring the interaction continues without prematurely ending the session. This feedback-driven process enables continuous learning and adaptation, convincing attackers they are engaging with a real device, thereby extending interaction durations and collecting richer, more detailed security insights [60]. Reinforcement learning often underlies the technologies used in adaptive honeypots. For example, HoneyIoT adapts over time by learning optimal responses, using feedback from attacker interactions to refine its strategies. First, the honeypot's RL agent can either exploit known responses or explore new actions, gradually identifying the best strategies.