Cyber threats, such as advanced persistent threats (APTs), ransomware, and zero-day exploits, are rapidly evolving and demand improved security measures. Honeypots and honeynets, as deceptive systems, offer valuable insights into attacker behavior, helping researchers and practitioners develop innovative defense strategies and enhance detection mechanisms. However, their deployment involves significant maintenance and overhead expenses. At the same time, the complexity of modern computing has prompted the rise of autonomic computing, aiming for systems that can operate without human intervention. Recent honeypot and honeynet research claims to incorporate autonomic computing principles, often using terms like adaptive, dynamic, intelligent, and learning. This study investigates such claims by measuring the extent to which autonomic principles principles are expressed in honeypot and honeynet literature. The findings reveal that autonomic computing keywords are present in the literature sample, suggesting an evolution from self-adaptation to autonomic computing implementations. Yet, despite these findings, the analysis also shows low frequencies of self-configuration, self-healing, and self-protection keywords. Interestingly, self-optimization appeared prominently in the literature. While this study presents a foundation for the convergence of autonomic computing and deceptive systems, future research could explore technical implementations in sample articles and test them for autonomic behavior. Additionally, investigations into the design and implementation of individual autonomic computing principles in honeypots and determining the necessary ratio of these principles for a system to exhibit autonomic behavior could provide valuable insights for both researchers and practitioners.
翻译:网络威胁,例如高级持续性威胁(APT)、勒索软件和零日漏洞利用,正在迅速演变,并需要改进的安全措施。蜜罐和蜜网作为欺骗性系统,为了解攻击者行为提供了宝贵见解,帮助研究人员和从业者开发创新的防御策略并增强检测机制。然而,它们的部署涉及大量的维护和开销成本。与此同时,现代计算的复杂性推动了自主计算的兴起,其目标是构建无需人工干预即可运行的系统。最近的蜜罐和蜜网研究声称融入了自主计算原则,常使用诸如自适应、动态、智能和自学习等术语。本研究通过衡量蜜罐和蜜网文献中自主计算原则的表达程度,对这些声称进行了探讨。研究结果显示,文献样本中存在自主计算关键词,表明从自适应到自主计算实现的演变。然而,尽管有这些发现,分析也表明自配置、自愈和自保护关键词的出现频率较低。有趣的是,自优化在文献中显得较为突出。虽然本研究为自主计算与欺骗性系统的融合奠定了基础,但未来研究可探索样本文章中的技术实现,并测试其自主行为。此外,调查蜜罐中各个自主计算原则的设计与实现,并确定一个系统表现自主行为所需这些原则的必要比例,可为研究人员和从业者提供宝贵的见解。