The notion of Honeypots has been in use in the network and information security field since the 1990s [5], and as such is not new. According to Lane Spitzner [3], Fred Cohen’s Deception Toolkit was regarded as the first instance of a Honeypot. It was used to deploy fake services which could be attacked by adversaries. However, the field of Honeypot has experienced consistent evolution particularly in areas such as architecture, deployment, and use [6] [7], and several Honeypot technologies have been proposed and developed since inception [7]:

• Shadow Honeypots are Honeypot deployments typically in cooperation with NIDS.

• Honeynet are Honeypots typically deployed in a distributed cooperative fashion.

• Honeytoken are typically fake digital resources such as data, files, and emails which can be deployed on the network and monitored for attacks.

• Honeywall is a type of Honeypot deployed for monitoring, controlling and analyzing attacks.

• Honeypot frameworks such as T-POT, Community Honey Network, and Modern Honey Network [8] employ docker technology for centralized deployment and management of different Honeypot types, thus enabling ease of deployment, use, and maintenance.

Honeypots can be classified based on 1) field of deployment—production and research Honeypots, and 2) the physicality of deployment—physical and virtual Honeypots [9]:

• Production Honeypots are deployed inside an organization’s production network (with other production servers) for improved network monitoring and security. They are easy to deploy and use, and can only capture limited attack information.

• Research Honeypots are deployed in organizations typically for researching vulnerabilities, threats, and attacks. They are complex to deploy and maintain, and can capture extensive attack and attacker information.

• Physical Honeypots are commonly deployed on bear-metal (i.e. physical computer systems).

• Virtual Honeypots, on the other hand, are deployed in virtualized environments with virtual compute resources.

Other common classifications are based on: 1) Honeypot’S level of interaction relating to the amount of attack information that can be gathered—low-interaction and high-interaction Honeypots, and 2) the direction of interaction relating to how attack traffic is initiated—client and server Honeypots [9]:

• Low-interaction Honeypots typically simulate only a set of operating system’s services and resources. They can be easily deployed and maintained, and are easily detected by attackers. Consequently, the amount of attack information that can be collected is limited as they are not capable of deceptively engaging attackers for so long. Collected data are mostly traffic flows from which valuable attack information (such as attack level, type, and source) can be statistically extracted.

• High-interaction Honeypots, on the other hand, are deployed as real operating systems resources, and as such are not easily detected by attackers. Their purpose is to get attackers to interact with fake operating systems data, applications, and/or services for longer time periods in order to collect, extract, and evaluate a wider scope of attacks and attacker information such as the attacker’s intentions, behavior, malware, commands, keystrokes, and tools. Additionally, high-interaction Honeypots are useful for detecting zero-day attacks and vulnerabilities, and consequently, are more resource-intensive, and difficult to deploy, maintain, and monitor.

• Server Honeypots are passive in that they wait to be probed, attacked, and/or compromised by adversaries.

• Client Honeypots, on the other hand, actively seek possible malicious internet-connected systems to initiate communication with.

Honeypots can also be classified based on the threat type being investigated or the application service being addressed [5]. Examples are, email, data, and malware:

• Email Honeypots are fake hidden email addresses deployed as decoys to be harvested by spammers and to trap, investigate, and block illicit spams emails in organizations.

• Decoy data Honeypots are fake data or databases deployed typically for monitoring attackers’ exploits on insecure computer systems architecture and software vulnerabilities such as SQL services exploitation and file systems privilege abuse.

• Malware is malicious computer software. Malware Honeypots typically run vulnerable remote connection (e.g. telnet, secure shell) and file system (e.g. server message block, application programming interface) application services, thus inviting malware attacks, and enabling trapping and storing of downloaded malware samples for further analysis.

Survey and/or review papers, in English language, relating to Honeypot research, from 2003 to 2021 were considered. Articles not relevant to our study were excluded, in particular, empirical studies, white papers, posters, and other survey and/or review papers that were not related to Honeypot technology.

To be selected, survey and/or review articles needed to present topics directly related to Honeypot technology and its variants such as shadow Honeypot, honeynet, and honeytoken. To be included in this study, selected papers needed to be qualitative and as such must meet one or more of the following requirements: 1) have been at least moderately cited; 2) is published by a reputable research-oriented organization with strong peer review process; 3) is published in a high impact peer-reviewed conference proceeding or journal.

To identify possible Honeypot survey and/or review papers, on the 30th of September, 2021 we first conducted a manual search of Honeypot-related articles using the Google Scholar web search interface to understand what key combinations to use as search strings. We used “Honeypot” as the search keyword and selected the “Review articles” option to view only survey and/or review-related papers. After quickly traversing 50 pages of the search results, we observed that most plausible Honeypot-related review and/or survey papers have the “survey” keyword used in their titles. Consequently, we conducted a second Google Scholar search using an automated python script [14] executed with default parameters through the Google Colaboratory web interface. The automated python script was configured to rank publications by the number of citations (per year) with the aim of revealing the most relevant survey papers in the field. For this search, the authors combined only two keywords—“Honeypot” and “survey”—as a search string.

• “Honeypot AND survey”

On the 11th of November 2021, a third search was conducted with to identify and update the search database with possibly missed and/or new records. Manual searches were performed directly from the Google Scholar web search interface up to the 20^th page and after the “Review articles” option was selected to view only survey and/or review-related papers. The search database was saved as a single CSV file and uploaded to Google Docs as a spreadsheet for further processing. For this search, specific keywords and phrases found in a number of Honeypot literature retrieved from the second search were combined into a complex search string (Table 1) in order to increase the scope of the search to include papers having other key terms, such as “honeynet”, “honeytoken”, “review”, “current state”, “trend” and “systematic literature review”.

• “(Honeypot OR honeynet OR honeytoken) AND (‘systematic literature review’ OR ‘literature review’ OR ‘survey’ OR ‘review’ OR ‘current state’ OR ‘trend’)”

Records of articles in the search database were found to have been indexed (by the Google Scholar search engine) from several online bibliographic databases. Most notable and of concern are: SpringerLink [15], ScienceDirect [16], IEEE Xplore [17], and ACM Digital Library [18]. Table 1 shows the attributes that characterizes the search operation such as: search engine type, search tool/interface type, date of coverage, search keyword and string, and source name.

This study follows a four-step process (data cleaning, first screening, second

screening, and article rating) for selection of sources based in the aforementioned inclusion and exclusion requirements.

In order to categorize, synthesize, and analyze each paper included in the final list, we collected data on the paper (Table 2), the study areas, and possible research openings.

First, we present a summary of each survey paper in the final list (by year) to give an overview of the breath of study and research direction. Then, we tabulate and chart the characteristics of the survey papers to give insights into the inter-relationships. We finally synthesized and discussed our findings based on the categorized Honeypot study areas and future research opportunities.

A total of 188 survey and/or review papers were initially retrieved as follows: 25 from SpringerLink [15]; 15 from ScienceDirect [16]; 38 from IEEE Xplore [17]; 9 from the ACM Digital Library [18]; and 101 from remaining sources. Before the screening phase, 38 duplicates and 10 records without authors and/or titles were removed remaining 140 records. After the title and abstract screening, 102 articles were excluded: 2 were white papers, 1 was poster, 1 was not in English, 53 were not survey and/or review papers, and 45 were not directly related to Honeypot technology. Thus, we retained 38 papers for further investigation. After the full-text screening, we further excluded 4 papers which were not Honeypot survey and/or review papers and as such were not relevant to this study. Thus, we selected 34 related Honeypot surveys and/or review papers and rated them based on our qualitative selection scheme as previously highlighted: 22 papers were identified as high-impact and thus were included in this study; 12 papers were identified as low-impact and were only added for statistical analysis. The PRISMA flow diagram of the source selection process is shown in Figure 1. It illustrates how the most relevant Honeypot related papers were identified, screened, and selected from our search database.

Several Honeypot related keywords and topics were identified and extracted during the screening and full-text reviews of the 34 selected papers. Based on these data, we created a 10-category classification scheme as shown in Table 4 In addition, we developed a visual representation of the classification scheme (Figure 8) showing the relationship between Honeypot technology, the main topics (key study areas) and the subtopics (keywords).

• Category C1—survey and/or review papers in this category discuss concepts, terminologies, definitions, classifications, and taxonomies in one or more of Honeypots, honeynets and honeytokens technologies [4] [5] [9] [22] - [39].

• Category C2—papers in this category present trends in Honeypot (and related) software, technologies, and tools [4] [5] [7] [9] [31] [32] [34].

• Category C3—papers in this category present trends in Honeypot (and related) deployments, architectures, designs, models, and configurations [4] [9] [22] [24] [26] [27] [30] - [38].

• Category C4—log collection, storage, collation, and data analysis tools, techniques, and methods were discussed [4] [5] [39].

• Category C5—papers in this category present discussions relating to Honeypot visualization tools, techniques, methods, and frameworks [5].

• Category C6—presents overviews on Honeypot detection, anti-detection, anti-introspection and adaptive concepts, techniques and approaches such as Game Theoretic Modelling (GTM) [4] [23] [28] [29] [32].

• Category C7—papers in this category, present discussions about legal and ethical concerns relating to Honeypot use and user privacy [4] [5] [7] [32] [37].

• Category C8—discuss Honeypot specialized applications areas such as in Teaching and Research, Cloud, Mobile, Wireless deployments, ML, Blockchain, Internet-of-Things (IoT), Industrial Control Systems (ICS), etc.), Botnet, Robotics, Crypto, Vehicular ad-hoc Network (VANET), and Smart Factory [22] [30] [33] [34] [35] [37] [38] [39].

• Category C9—present discussion on Honeypot use cases, advantages, disadvantages, other emerging trends, challenges, open issues, and future research directions [7] [9] [23] [25] [26] [29] [31] [34] [35] [36] [37] [38] [39].

• Category C10—present other study areas which are novel, emerging, or distinct and are not classifiable under any previously motioned categories. As an example, Technology Independent Honeynet Description Language (TIHDL) [26].

Selected papers cover key Honeypot study areas as identified by Bringer et al. [4].

As shown in Table 5, all the articles (published and preprints) presented a form of background in Honeypot technology as explained in C1 above. About 35% (12 articles) presented Honeypot types; 62% (21 articles) topics relating to types of Honeypot deployments; 24% (8 articles) Honeypot detection; and 21% (7 articles) topics relating to Honeypot ethical/legal issues. We found data analysis (3 papers) and visualization (1 paper) study areas to have little survey and/or review contributions (C4 and C5). In addition, about 35% (12 articles) addressed specialized Honeypot applications and about 38% (13 articles) presented topics in Category C9. Only one (1) article was intentionally classified as Category C10.

We consider Technology Independent Honeynet Description Language (TIHDL) [26] a novel, distinct, and emerging honey field.

Furthermore, discussions on Honeypot topics in categories C1 (concepts), C3 (deployment) and C9 (general) have been found to be mostly prevalent in the selected survey and/or review papers as shown in Figure 9. This may be a clear indication that these topics typically receive more attention from within the research community. Similarly, study areas in categories C2 (software), C6 (detection), C7 (legal/ethical) and C8 (special applications) have also received considerable share of attention—again, with the exception of topics in categories C4 and C5.

We identified a number of open research questions and future research opportunities from the selected survey and/or review papers [23] [26] [29] [34] [35] [36] [38] [39]. As show in Table 6, these have been grouped by application or domain areas—particularly, in categories C6, C2, C3, and C10. This section provides researchers an overview of possible research directions.

The authors [26] presented an overview of existing common descriptive languages and proposed one that could be used in the configuration and management of disparate honeynet deployments, included in a flexible configuration tool—HoneyGen [43]. They [26] suggested, most importantly: 1) extending the HoneyGen [43] tool for compatibility with more honeynet platforms; and 2) studying of the automatic translation between the proposed technology independent language and the proprietary deployment languages of honeynet platforms. Similarly, the authors [36] suggested further study is needed in Honeypot deployments against internal and external attacks and its applications in various networks.

As the black hat community continues to improve the sophistication of malwares for effective (execution environment) fingerprinting, authors [29] proposed future research direction as: 1) the development of new ways to identify and classify malware detection vectors; and 2) the development of inexpensive, and more robust and adaptive Honeypot solutions with better and advanced deception. Additionally, the authors [23] acknowledge that very little research work was done in applying Artificial Intelligence (AI) techniques for development of dynamic and intelligent Honeypot systems, and farther proposed the use of already existing AI techniques such as Expert Systems (ES) [40], Fuzzy Logic (FL) [41], and Swarm Intelligence (SI) [42]. In a similar direction, the authors [38] presented the concern of selecting qualitative dataset for development of machine learning models, due to the availability of different training malware datasets collected at different times using Honeypot platforms.

Hence, they [38] suggested further Honeypot development which establishes a fit-for-use of malware data.

Vehicular ad-hoc network (VANET) [57] and Internet-of-Things [58] are some of the rising specialized application areas benefiting from Honeypot research. VANET involves a spontaneous creation of wirelessly connected vehicles in a network in which vehicles can join or leave at will. The authors [35] presented an overview of IDS and Honeypot systems in VANET and VANET Cloud networks. They [35] suggested future research works relating to: 1) how to effectively position a Honeypot in VANET to aid detection capability and overall performance; 2) detection of novel and previously unknown vulnerabilities and attacks; 3) collection of up-to-date attack dataset that truly represents the attack process; 4) investigating benefits and disadvantages of existing Honeypot deployment methods and attack detection techniques; 5) to improve and use of some generalized validation strategies; 6) development of Honeypot auto detection and response system; 7) development of intelligent and predictive Honeypot systems.

Internet-of-Things (IoT), on the other hand, involves the networking of physical sensor-embedded objects for the purpose of inter-communication over the internet. The authors [34] presented an overview of IoT and Industrial Control Systems. They [34] suggested: 1) further review of attacks on IoT devices based on security metrics (such as source IP, source ports, malware login/password, type and distribution of attack source, etc.) characterizing the attacker; 2) design of an intelligent IoT Honeypot which can adapt to attacker’s interaction level. Similarly, the authors [39] presented a survey on Honeypot and honeynet systems in use in IoT and Cyber Physical System (CPS) application areas. They [39] suggested as future research works (broadly categorized): 1) development of Honeypot systems for effective insider attack detection and mitigation; 2) investigating technologies, platforms, and domains recently becoming prominent; 3) investigating established but yet unexplored protocols; 4) investigating effective deployment locations and remote management; 5) investigating effective anti-Honeypot and ant-detection approaches.