MalCoBox: Designing a 10 Gb/s Malware Collection Honeypot Using Reconfigurable Technology

Honeypots present networked computer systemswith known security flaws to attackers and can serve tocollect the executable code (malware) aiming to exploit thevulnerability. We describe and evaluate the proof-of-conceptNetStage Architecture for a high-speed honeypot realized inreconfigurable logic. Dedicated hardware accelerators for thedifferent network processing and detection layers allow thehoneypot to operate at full speed of a 10 Gb/s connection andproject the illusion of thousands of vulnerable systems at once.Furthermore, compromising the honeypot itself is significantlymore difficult than in software honeypots, since all processingis handled by specialized hardware blocks instead of generalpurpose processors.