| A honey pot simulates multiple platforms and services used to attract and contain the attackers.
To the attacker, it appears to be part of a production network providing services. A honey pot can be one or more hosts deployed within a DMZ or screened sub-net. Honey pots can be used for surveillance, as an early-warning tool, to discover security weaknesses, and to help assess threats. They also will tie up an attacker's resources as they burn time and effort. Honey pots should have no production value, and should not see any legitimate traffic or activity. Whatever they capture is malicious or unauthorized traffic.
Identification of malicious code is not a function of DNS. |
