🔀 SDN Dynamic Honeypot

Dynamic honeypot migration via SDN flow rules.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

In Software-Defined Networking environments, dynamically migrate honeypots across the network topology in response to detected scanning activity. When an attacker probes a subnet, the SDN controller transparently redirects traffic to a honeypot that appears at the scanned IP.

Implementation requirements

SDN controller (OpenDaylight, ONOS, or cloud VPC flow control)
OpenFlow rules for dynamic traffic redirection
Pre-staged honeypot pool that can assume any IP identity
Low-latency controller to avoid detection via response time analysis
Safety: keep the honeypot pool on an isolated segment with outbound traffic denied or tightly rate-limited, so an attacker who takes over a honeypot cannot use it to reach real hosts or the internet
Safety: redirect only flows that already match a high-confidence trigger, and allow-list critical production flows so a false positive cannot divert real users. Give every redirect rule an expiry, and log each redirect decision
Rollback: removing the controller's redirect rules restores normal forwarding. Test that removal before going live
Upkeep: Test the redirect and its removal after every controller upgrade. Review the allow-list of critical flows quarterly.

Technologies

Network

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1018 Remote System Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) A Virtual Honeypot Framework — Decoy hosts on unused addresses are found, and logged, by an attacker mapping the network. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1018 to its Lures activity.
T1046 Network Service Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1046 to its Lures activity. Koney: A Cyber Deception Orchestration Framework for Kubernetes — (D029) Koney uses service meshes and eBPF to add traps to containerised applications; probing a trap is logged.

Evidence

Exploring Honeypot as a Deception and Trigger Mechanism for Real-Time Attack Detection in Software-Defined Networking — Khalid, H. Y.; Aldabagh, N. B., Int. J. Computing and Digital Systems 16(1) 2024 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard

Research basis: Harman Khalid, "Exploring Honeypot as a Deception and Trigger Mechanism for Real-Time Attack Detection in SDN" — University of Bahrain Journals, 2024.