Detecting malicious web servers with honeyclients

Using malicious sites to launch attacks against client user applications is a growing threat in recent years. This led to emergence of new technologies to counter and detect attacks against end user. One of these technologies is honeyclient (aka client honeypot). Honeyclients crawl the Internet to find and identify web servers that exploit clientside vulnerabilities. In this paper, we address honeyclients by studying and analyzing low-interaction and highinteraction honeyclients. We introduce a comparison attributes to evaluate honeyclients by comparing between the two types. Moreover, we present techniques can be used by malicious websites to evade and fingerprint honeyclients, and we make recommendations to overcome these evasion techniques. By analyzing characteristics of honeyclients, we introduce factors to define and measure honeyclients effectiveness.