Automatic generation of low-interaction honeypots

A computer implemented method to automatically generate low-interaction honeypots, comprising:

• identifying one or more representative applications associated with a plurality of resources in a network;
• automatically generating one or more low-interaction honeypots for the identified one or more representative applications;
• probing the one or more representative applications to retrieve a plurality of responses corresponding to a plurality of requests;
• generating one or more templates corresponding to one or more request-response pairs by parsing the plurality of responses and the plurality of requests;
• responding, through the one or more low-interaction honeypots, to one or more new requests for accessing the plurality of resources using the generated one or more templates,
• wherein responding to the one or more new requests for accessing the plurality of resources using the one or more templates comprises analyzing the one or more templates to determine best templates to respond to the one or more new requests and generating the corresponding responses based on the determined best templates;
• and
• recording the one or more new requests and corresponding responses.

A computing system to automatically generate low-interaction honeypots, comprising:

• at least one processor;
• and
• one or more memory devices communicative with the at least one processor, wherein the one or more memory devices store instructions to:
• identify one or more representative applications associated with a plurality of resources in a network;
• automatically generate one or more low-interaction honeypots for the identified one or more representative applications;
• probe the one or more representative applications to retrieve a plurality of responses corresponding to a plurality of requests;
• generate one or more templates corresponding to one or more request-response pairs by parsing the plurality of responses and the plurality of requests;
• respond, through the one or more low-interaction honeypots, to one or more new requests for accessing the plurality of resources using the generated one or more templates,
• wherein responding to the one or more new requests for accessing the plurality of resources using the one or more templates comprises analyzing the one or more templates to determine best templates to respond to the one or more new requests and generating the corresponding responses based on the determined best templates;
• and
• record the one or more new requests and corresponding responses.