{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T23:28:16Z","timestamp":1783553296424,"version":"3.55.0"},"reference-count":93,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2018,12,1]],"date-time":"2018-12-01T00:00:00Z","timestamp":1543622400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"crossref","award":["2016YFB1000602"],"award-info":[{"award-number":["2016YFB1000602"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"crossref","award":["2017YFB0701501"],"award-info":[{"award-number":["2017YFB0701501"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]},{"name":"MOE Research Center for Online Education Foundation","award":["2016ZD302"],"award-info":[{"award-number":["2016ZD302"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61440057"],"award-info":[{"award-number":["61440057"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61363019"],"award-info":[{"award-number":["61363019"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Systems Journal"],"published-print":{"date-parts":[[2018,12]]},"DOI":"10.1109\/jsyst.2017.2762161","type":"journal-article","created":{"date-parts":[[2017,11,7]],"date-time":"2017-11-07T19:08:17Z","timestamp":1510081697000},"page":"3906-3919","source":"Crossref","is-referenced-by-count":70,"title":["Enabling an Anatomic View to Investigate Honeypot Systems: A Survey"],"prefix":"10.1109","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7363-9695","authenticated-orcid":false,"given":"Wenjun","family":"Fan","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8435-1611","authenticated-orcid":false,"given":"Zhihui","family":"Du","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Fernandez","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Victor A.","family":"Villagra","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/586143.586146"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.4108\/eai.3-12-2015.2262516"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/972374.972384"},{"key":"ref70","first-page":"1","article-title":"Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits\n on commodity software","author":"newsome","year":"0","journal-title":"Proc 12th Annu Netw Distrib Syst Security Symp"},{"key":"ref76","article-title":"Advanced honeypot architecture for network threats quantification","author":"berthier","year":"2009"},{"key":"ref77","article-title":"The libnetfilter_queue project","author":"welte","year":"2014"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/354871.354874"},{"key":"ref39","first-page":"1664","article-title":"Nose-building virtual honeynets\n made easy","author":"stumpf","year":"0","journal-title":"Proc 12th Int Linux Syst Technol Conf"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2015.05.005"},{"key":"ref38","first-page":"600","article-title":"Use of vnuml in virtual honeynets deployment","author":"gal\u00e1n","year":"0","journal-title":"Reunión Española sobre Criptología y Seguridad de la Información"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1002\/sec.764"},{"key":"ref79","doi-asserted-by":"crossref","first-page":"164","DOI":"10.1007\/978-3-642-38631-2_13","article-title":"Towards hybrid honeynets via virtual\n machine introspection and cloning","volume":"7873","author":"lengyel","year":"2013","journal-title":"Network and System Security"},{"key":"ref33","first-page":"232","article-title":"Virtual honeynets revisited","author":"yan","year":"0","journal-title":"Proc 6th Annu IEEE SMC Inf Assurance Workshop"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/s12243-009-0104-3"},{"key":"ref31","author":"provos","year":"2007","journal-title":"Virtual Honeypots From Botnet Tracking to Intrusion Detection"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CRISIS.2012.6378948"},{"key":"ref37","article-title":"Creating honeypots using docker","author":"kasza","year":"2015"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TENCONSpring.2014.6863084"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2007.4455171"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/ATNAC.2009.5464785"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-31909-9_12"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664252"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.11"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028794"},{"key":"ref28","article-title":"Specter: A commercial honeypot solution for windows","author":"spitzner","year":"2003"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/1330107.1330135"},{"key":"ref27","article-title":"Know your enemy: Honeynets","year":"2006"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2006.09.005"},{"key":"ref66","first-page":"1","article-title":"Protocol-independent adaptive replay of application\n dialog","author":"cui","year":"0","journal-title":"Proc 13th Netw Distrib Syst Secur Symp"},{"key":"ref29","article-title":"Glastopf project","author":"rist","year":"2009"},{"key":"ref67","first-page":"15","article-title":"Collapsar: A VM-based architecture for network attack detention center","author":"jiang","year":"0","journal-title":"Proc Usenix Security Symp"},{"key":"ref68","article-title":"Know your enemy: Honeywall cdrom","year":"2005"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-007-0067-8"},{"key":"ref2","article-title":"Internet security threat report","volume":"21","year":"2016"},{"key":"ref1","first-page":"90g","article-title":"The newest warfighting domain: Cyberspace","volume":"4","author":"brandes","year":"2013","journal-title":"Synesis J Sci Technol Ethics Policy"},{"key":"ref20","article-title":"Cuckoo","year":"2014"},{"key":"ref22","article-title":"The darknet project","author":"cymru","year":"2015"},{"key":"ref21","article-title":"Network telescopes:\n Technical report","author":"moore","year":"2004"},{"key":"ref24","first-page":"167","article-title":"The internet motion sensor: A distributed blackhole monitoring\n system","author":"bailey","year":"0","journal-title":"Proc Symp Network and Distributed System Security"},{"key":"ref23","first-page":"1","article-title":"A snapshot\n of global Internet worm activity","author":"song","year":"0","journal-title":"Proceedings of the 14th Annual Computer Security Incident Handling Conference"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/1095810.1095825"},{"key":"ref25","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1007\/978-3-540-30143-1_8","article-title":"On the\n design and use of internet sinks for network abuse monitoring","volume":"3224","author":"yegneswaran","year":"2004","journal-title":"Recent Advances in Intrusion Detection"},{"key":"ref50","article-title":"GQ: Realizing a system\n to catch worms in a quarter million places","author":"cui","year":"2006"},{"key":"ref51","article-title":"Know your enemy: Sebek, a kernel based data capture tool","year":"2003"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.4304\/jcp.7.3.692-698"},{"key":"ref92","article-title":"Camouflaging virtual honeypots","author":"fu","year":"2005"},{"key":"ref91","first-page":"1","article-title":"A novel anti-phishing framework based on honeypots","author":"li","year":"0","journal-title":"Proc 2009 eCrime Res Summit"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/EDCC-7.2008.15"},{"key":"ref59","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1007\/978-3-642-25141-2_7","article-title":"Nitro:\n Hardware-based system call tracing for virtual machines","volume":"7038","author":"pfoh","year":"2011","journal-title":"Advances in Information and Computer Security"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315262"},{"key":"ref57","first-page":"233","article-title":"Lares: An architecture for secure active\n monitoring using virtualization","author":"payne","year":"0","journal-title":"Proc 2008 IEEE Symp Security and Privacy"},{"key":"ref56","first-page":"191","article-title":"A virtual machine introspection based architecture for intrusion detection","author":"garfinkel","year":"0","journal-title":"Proc Symp Network and Distributed System Security"},{"key":"ref55","article-title":"LibVMI","year":"2015"},{"key":"ref54","doi-asserted-by":"crossref","first-page":"198","DOI":"10.1007\/978-3-540-74320-0_11","article-title":"Out-of-the-box monitoring of VM-based high-interaction honeypots","volume":"4637","author":"jiang","year":"2007","journal-title":"Recent Advances in Intrusion Detection"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.45"},{"key":"ref52","article-title":"Know your tools: Qebek—Conceal the monitoring","year":"2010"},{"key":"ref10","article-title":"A hybrid honeypot architecture for scalable network monitoring","author":"bailey","year":"2004"},{"key":"ref11","article-title":"A survey on honeypot software and data analysis","author":"nawrocki","year":"2016"},{"key":"ref40","first-page":"1","article-title":"Distributed virtual scenarios over multi-host\n linux environments","author":"fern\u00e1ndez","year":"0","journal-title":"Proc 5th Int DMTF Academic Alliance Workshop Syst Virtualization Manage"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/MSECP.2003.1193207"},{"key":"ref13","article-title":"Virtual machine introspection in a hybrid honeypot architecture","author":"lengyel","year":"0"},{"key":"ref14","author":"stoll","year":"2000","journal-title":"The Cuckoo's Egg Tracking a Spy Through the Maze of Computer Espionage"},{"key":"ref15","first-page":"163","article-title":"An evening with berferd in which a cracker is lured, endured, and\n studied","author":"cheswick","year":"0","journal-title":"Proc Winter Usenix Conf"},{"key":"ref82","first-page":"1","article-title":"A novel SDN based stealthy TCP connection handover mechanism for hybrid honeypot systems","author":"fan","year":"0","journal-title":"Proc IEEE 3rd Conf Netw Softwarization"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2003.1254322"},{"key":"ref81","first-page":"311","article-title":"Dynamic hybrid honeypot system based\n transparent traffic redirection mechanism","author":"fan","year":"2015","journal-title":"Proc 17th Int Conf Inf Commun Secur"},{"key":"ref17","first-page":"1","article-title":"A virtual honeypot framework","author":"provos","year":"0","journal-title":"Proc 13th Conf Usenix Security Symp"},{"key":"ref84","article-title":"pof v3","author":"zalewski","year":"2012"},{"key":"ref18","article-title":"Dionaea—Catched bugs","year":"2011"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2013.110"},{"key":"ref19","article-title":"Cowrie—Active kippo fork","author":"oosterhof","year":"2015"},{"key":"ref80","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/978-3-319-25744-0_1","article-title":"Adaptive and flexible\n virtual honeynet","volume":"9395","author":"fan","year":"2015","journal-title":"Mobile Secure and Programmable Networking"},{"key":"ref89","article-title":"Know your enemy: Genii honeynets","year":"2005"},{"key":"ref4","article-title":"What do\n firewalls protect? An empirical study of firewalls, vulnerabilities, and attacks","author":"peisert","year":"2010"},{"key":"ref3","first-page":"253","article-title":"An environmental approach to understanding cyberpower","author":"rattray","year":"2009","journal-title":"Cyberpower and National Security"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.5815\/ijcnis.2017.01.01"},{"key":"ref5","first-page":"9","article-title":"Detecting targeted attacks using shadow honeypots","volume":"14","author":"anagnostakis","year":"0","journal-title":"Proc 14th Conf USENIX Security Symp"},{"key":"ref85","article-title":"Namp","author":"lyon","year":"2015"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/1217935.1217938"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2006.172"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2012.06.001"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.20533\/ijicr.2042.4655.2015.0071"},{"key":"ref87","first-page":"6:1","article-title":"A survey on automated dynamic\n malware-analysis techniques and tools","volume":"44","author":"egele","year":"2008","journal-title":"ACM Comput Surv"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-2010-0410"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2006.02.009"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.4018\/jitn.2012070101"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2011.5990712"},{"key":"ref48","first-page":"1","article-title":"IoTPOT: Analysing the rise of IoT compromises","author":"pa","year":"0","journal-title":"Proc USENIX Workshop Offensive Technol"},{"key":"ref47","article-title":"Conpot ICS\/SCADA honeypot","author":"rist","year":"2013"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/NSS.2009.65"},{"key":"ref41","doi-asserted-by":"crossref","first-page":"38","DOI":"10.1049\/iet-ifs.2015.0256","article-title":"Versatile\n virtual honeynet management framework","volume":"11","author":"fan","year":"2016","journal-title":"IET Inf Security"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2876019.2876022"},{"key":"ref43","first-page":"16","article-title":"DarkNOC: Dashboard for honeypot management","author":"sobesto","year":"0","journal-title":"Proc Int Conf Large Installation Syst Admin"}],"container-title":["IEEE Systems Journal"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/4267003\/8543256\/08098608.pdf?arnumber=8098608","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,1,27]],"date-time":"2022-01-27T02:57:55Z","timestamp":1643252275000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8098608\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,12]]},"references-count":93,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/jsyst.2017.2762161","relation":{},"ISSN":["1932-8184","1937-9234","2373-7816"],"issn-type":[{"value":"1932-8184","type":"print"},{"value":"1937-9234","type":"electronic"},{"value":"2373-7816","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,12]]}}}