Client honeypots: Approaches and challenges

In recent years, client user has become the main target for attacks, as the adversary believe that the end user is the weakest link in the security chain. Traditional honeypots and security tools are not effective against these new attacks. Therefore, client honeypot has appeared as new technology to supplement the existing protection tools. Client honeypot is a honeypot actively searches for malicious sites on the web. In this paper, we will show and analyze the main approaches used by client honeypots to detect client-side attacks. We will also address how attacker can evade and hide from client honeypots. Moreover, we discuss and analyze various issues relates to client honeypot: detection problems, invisibility of honeypots, and integrity issues. By analyzing characteristics of client honeypots, we will introduce factors to define and measure client honeypots effectiveness.