# Optimizing Internet of Things Honeypots with Machine Learning: A Review
## 2 Theoretical Background
### Honeypot  
Honeypots are a tool for cyber deception that was initially introduced in the 1990s [4]. They are used to detect intruders and trick them into connecting to a certain system within the network. Ultimately, any data collected by an honeypot can be categorized as malicious and the result of an intrusion [10]. This can be interpreted in contrast to the fact that honeypots are useless if they are detected and subsequently avoided by attackers [11]. Honeypots can be divided into two main categories, depending on their purpose: research honeypots and production honeypots [11]. The purpose of the research honeypot is to collect, observe, and study the actions of attackers and the tools they use to penetrate the system. Its purpose is to identify unknown vulnerabilities and attacks [11]. Therefore, its main purpose is to collect information about how attackers operate and execute attacks in preparation for the possibility of a real attack on an organization. However, it should be noted that the research honeypot itself does not contribute to security, but only the collected data can be used to improve security in the future [12]. In contrast to research honeypots, production honeypots are primarily used for defense. They are placed in the production network behind the firewall and serve to mislead attackers by simulating a real system. This deception not only distracts attackers from the actual system but also notifies system administrators of potential attackers [11]. Production honeypots mimic corporate networks or services and entice attackers to expose vulnerabilities while collecting valuable data. They excel at detection performance by addressing common issues of IDS such as false positives and negatives and handling large traffic volumes. Unlike IDS, traffic to a honeypot is not likely to be authorized, simplifying analysis and reducing noise. While less effective as a standalone prevention mechanism, they complement robust security measures such as firewalls and system patching. Honeypots also enable detailed forensic analysis by isolating compromised computers without disrupting production systems [12]. As mentioned earlier, honeypots can be categorized by their purpose. Another very important way of categorizing honeypots is by their level of interaction. In general, honeypotscan be divided as low-, medium-, and high-interaction honeypots [13]. Low-interaction honeypots simulate limited services without providing full system access, thus reducing risks but offering restricted functionality [13]. Examples like Honeyd and Specter are easy to implement, providing a facade for attackers while supporting the analysis of threats such as spammers and worms [12]. Medium-interaction honeypots, on the other hand, offer more technical complexity than low-interaction honeypots, but they remain less advanced than high-interaction ones. They simulate services that create a more convincing illusion of an operating system, enabling the logging and analysis of more sophisticated attacks while maintaining a low risk of compromise [14]. Examples such as mwcollect, nepenthes, and honeytrap are characterized by collecting malware and handling some unknown attacks through dynamic responses [12]. High-interaction honeypots are the most advanced, providing attackers with a real operating system to interact with, which allows for extensive data collection and analysis. However, they are complex to design, carry higher risks, and require constant monitoring to prevent them from becoming security vulnerabilities. Honeynets are a notable example, primarily used for research purposes [12,13]. Honeypots offer significant advantages as well as significant risks, making them a valuable but cautious addition to security mechanisms. On the one hand, they excel at collecting small, high-value datasets by focusing exclusively on traffic directed at them, avoiding the burdens of overwhelming logs or excessive alerts.