Beyond Static Defense: Dynamic Honeypots for Proactive Threat Engagement

This paper presents a pioneering approach to cyber-security training through the development and optimization of a dynamic honeypot system (called potnet) tailored for Capture the Flag (CTF) competitions as well as real world situations. Traditional open-source honeypot projects often exhibit recognizable patterns, failing to effectively engage attackers and divert their attention from genuine systems. Motivated by the imperative to foster deeper engagement within CTF contexts, we introduce a novel solution that simulates a semi-realistic network subnet with dynamically scalable fake services. This system aims to continuously captivate attackers' attention, encouraging exploration and interaction within the emulated environment. The study delves into the intricacies of deploying and maintaining such a system, including containerized environment management, log orchestration, and robust security measures to fortify challenge instances. By eschewing reliance on existing open-source tools, we address the limitations of conventional approaches and pave the way for a more engaging and effective training environment. Through empirical evaluation and comparative analysis, we demonstrate the efficacy of our system in enhancing threat analysis capabilities and optimizing honeypot performance within CTF scenarios. The paper concludes with a discussion on the future trajectory of dynamic honeypot systems, highlighting the potential for further innovation and collaboration in the cybersecurity training domain.