Search

Research on Network-Attack Behavior Capture and Traceability Technology Based on Automatic-Capture Traceable Honeypot Platform

Author(s)

Zongchuan Feng1,2, Linrong Yan1*, Jie Qiu1

Affiliation(s)

1School of Artificial Intelligence, Yulin Normal University, Yulin, Guangxi, China 2Yulin Normal University Education Technology Center, Yulin, Guangxi, China *Corresponding Author

Abstract

Cyberattacks are evolving toward industrialization, diversification and concealment. Complex multi-stage attack chains, incomplete retention of intrusion behaviors and difficulties in forensic traceability have become urgent challenges in cybersecurity defense. Traditional static testbeds can only reproduce standardized vulnerability-exploitation procedures; they struggle to fully capture full-life-cycle attack behaviors and restore real-world attack chains, which results in incomplete forensic evidence chains. To address these limitations, this paper proposes a technical scheme based on a high-interaction automatic-capture traceable honeypot platform for attack deception, multi-dimensional behavior collection and automatic link traceability. A three-layer technical architecture (bottom simulation-support layer, middle data-processing layer and top analysis-output layer) is constructed to realize business-service simulation, full-volume attack-behavior capture, automatic attack-link traceability and isolated experimental-domain control. A closed-loop workflow of “attack deception-raw-data acquisition-multi-source data correlation-trace-link generation-forensic-evidence export” is designed. The platform records attack-source information, operation commands, tool parameters, network traffic and time-series trajectories comprehensively, and generates visual attack-trace graphs automatically. Comparative experiments are conducted to validate data-capture completeness and trace-link-restoration performance. Experimental results demonstrate that the proposed scheme can preserve full-life-cycle attack behaviors including failed probing attempts, reconstruct complete attack chains, and mitigate technical drawbacks such as fragmented attack records and manually-assembled trace evidence in conventional simulation environments. This research provides technical support and experimental paradigms for network-intrusion behavior analysis, attack traceability and cyber-threat perception.

Keywords

High-Interaction Honeypot; Automatic Capture; Attack Traceability; Behavior Collection; Threat Perception; Digital Forensics

References

[1] Cheswick B. An evening with Berferd in which a cracker is lured, endured, and studied//Proceedings of the Winter USENIX Conference. San Francisco: USENIX Association, 1992:20-24. [2] Franco J, Aris A, Canberk B, et al. A survey of honeypots and honeynets for Internet of Things, industrial Internet of Things, and cyber-physical systems. IEEE Communications Surveys & Tutorials, 2021, 23(4):2351-2383. [3] Antonakakis M, April T, Bailey M, et al. Understanding the Mirai botnet//26th USENIX Security Symposium. Vancouver: USENIX Association, 2017:1093-1110. [4] Wang L, Deng J, Tan H, et al. AARF: Autonomous attack response framework for honeypots to enhance interaction based on multi-agent dynamic game. Mathematics, 2024, 12(10):1508. [5] Hassan W U, Noureddine M A, Datta P, et al. OmegaLog: High-fidelity attack investigation via transparent multi-layer log analysis//Proceedings of the Network and Distributed System Security Symposium. San Diego: Internet Society, 2020. [6] Javadpour A, Ja’fari F, Taleb T, Shojafar M, Benzaïd C. A comprehensive survey on cyber deception techniques to improve honeypot performance. Computers & Security, 2024, 140:103792. [7] Matencio Escolar A, Wang Q, Alcaraz Calero J M. Enhancing honeynet-based protection with network slicing for massive Pre-6G IoT Smart Cities deployments. Journal of Network and Computer Applications, 2024, 229:103918. [8] Pour M, Khoury J, Bou-Harb E. HoneyComb: A darknet-centric proactive deception technique for curating IoT malware forensic artifacts//2022 IEEE/IFIP Network Operations and Management Symposium. Budapest: IEEE, 2022:1-9. [9] Heluany J B. PLC honeypots: Enhancing interaction-level assessment. Electronics, 2024, 13(20):4024. [10] Garfinkel S. Digital forensics research: The next 10 years. Digital Investigation, 2010, 7:S64-S73.