Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm interested in learning more about Honeypots and Honeynets. I've used low interaction Honeypots like Honeyd in the past, but now I want to take it to the next level.

Can anyone recommend any good books or papers about Honeypots/Honeynets?


locked by Chris S Feb 8 '12 at 0:23

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

up vote 8 down vote accepted

There are a few books on the subject (although I've never bothered with them), however I can recommend you some readily updated websites:

The always interesting honeyblog

The European Network of Affined Honeypots has many recent papers and presentations

The Honeynet Project has some good papers

Distributed honeypot management software and a video discussion of the current state of the threat

A directory of honeypot server related sites

Shadowserver has some good general stats

Finally there are some old (circa 2000) papers cited in this article

Thank you Andy! This was exactly what I had in mind :) – Thus Aug 28 '09 at 8:56
No problemo :) – Andy Aug 28 '09 at 12:13

I just finished reading the book Beautiful Security, and it has a nice chapter on 'honey clients'. Instead of focusing on server side exploits, they look at how malware installs itself onto a client. The book has some good suggestions on using VMWare, and detecting system changes.

Beautiful Security


Not the answer you're looking for? Browse other questions tagged or ask your own question.