A theoretical method to evaluate honeynet potency

Abstract

The honeynet is a vulnerable and simulated computer network that is commonly used to improve network security. A profound evaluation of honeynet potency is crucial to the effective design and improvement of a honeynet. For that purpose, a new dynamical model for evaluating the honeynet potency is proposed and analyzed in this paper. The proposed model incorporates honeypots into the model formulation as state variables, and mathematical analysis finds that a key role for deciding the honeynet potency is the greatest characteristic value of the deployed network. Particularly, the range of characteristic values clearly forms the delimitation among the infection propagation between two explicit embranchments, below which the honeynet works at its best level, until malware tends toward the extinction, and above which the malware persists at a certain level. The proposed model is verified by numerical simulations on several representative computer networks. Based on the theoretical and numerical results, a discussion is provided. Accordingly, the results show that the honeynet potency can be explicitly enhanced by either properly reducing the number of links and the greatest node degree of the deployed network, or strengthening the data control or patch feedback function of the honeypot. The results presented in this paper can provide guidance on effective honeynet design.