# Gotta catch 'em all: a Multistage Framework for honeypot fingerprinting

arXiv: https://arxiv.org/abs/2109.10652 · HTML: https://mlsanity.com/paper/2109.10652/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Sep 2021.

## Built on by (most cited first, 2 of 2)

- [SimProcess: High Fidelity Simulation of Noisy ICS Physical Processes](https://mlsanity.com/paper/2505.22638/) (2025)
- [An Adaptive Multi-Layered Honeynet Architecture for Threat Behavior Analysis via Deep Learning](https://mlsanity.com/paper/2512.07827/) (2025)

## Abstract (arXiv)

Honeypots are decoy systems that lure attackers by presenting them with a seemingly vulnerable system. They provide an early detection mechanism as well as a method for learning how adversaries work and think. However, over the last years, a number of researchers have shown methods for fingerprinting honeypots. This significantly decreases the value of a honeypot; if an attacker is able to recognize the existence of such a system, they can evade it. In this article, we revisit the honeypot identification field, by providing a holistic framework that includes state of the art and novel fingerprinting components. We decrease the probability of false positives by proposing a rigid multi-step approach for labeling a system as a honeypot. We perform extensive scans covering 2.9 billion addresses of the IPv4 space and identify a total of 21,855 honeypot instances. Moreover, we present a number of interesting side-findings such as the identification of more than 354,431 non-honeypot systems that represent potentially vulnerable servers (e.g. SSH servers with default password configurations and vulnerable versions). Lastly, we discuss countermeasures against honeypot fingerprinting techniques.