Poster: Toward Dynamic, Session-Preserving, Transition from Low to High Interaction Honeypots

Honeypots are technologies aimed at thwarting adversaries by instituting attractive services that are inconsequential to the legitimate objectives of a network. Low-interaction honeypots are lightweight, but provide a limited representation of real services, while high-interaction honeypots can mimic entire systems and services, but their computational costs are expensive, and are not always viable solutions, especially in constrained environments. This work is investigating the feasibility of being able to start with a low-interaction network service and then transitioning to a high-interaction service on-the-fly. During this transition, there should be no observable distinction from the perspective of a connecting client. This paper describes ongoing work that demonstrates a basic prototype with such a capability, specifically showing that a simple Netcat listener process can dynamically transition to a full NGINX server dynamically and without severing an active TCP session.