J-Honeypot: a Java-based network deception tool with monitoring and intrusion detection

In this paper, we describe the development of J-Honeypot, a Java-based network deception tool with a Web-based monitoring interface and a rule-based intrusion detection engine. Our J-Honeypot is based on the Honeyd program by Niels Provos, but features important enhancements. First, since J-Honeypot is written in Java, it can potentially run on various platforms, Windows or UNIX, workstations or handheld devices. Second, J-Honeypot has a rule-based intrusion detection engine, whose design is guided by the analysis of real world attack data. The attack data was collected by opening up our J-Honeypot to solicit possible attacks. Third, J-Honeypot includes a Web-based monitoring tool that is easily accessible and can help network administrators better understand network traffic and possible attacks.