THE ROLE OF HONEYPOTS IN CYBER DEFENSE: A COMPARATIVE AND EXPERIMENTAL PERSPECTIVE

This thesis explores the critical role of honeypots in cybersecurity, focusing on their ability to analyze and mitigate cyber threats. It provides a comprehensive review of honeypot technologies, comparing various tools available in the market based on their design, interaction levels, and data collection capabilities. The research highlights the differences between standalone solutions like Cowrie, a medium-to-high interaction SSH honeypot, and advanced platforms such as T-Pot, which integrates multiple honeypots and visualization tools for enhanced data analysis. An experimental analysis is conducted to evaluate the practical effectiveness of these solutions in gathering valuable insights into attacker behaviors, including attack vectors, exploited vulnerabilities, and geographical origins of threats. The study emphasizes the importance of honeypots as proactive cybersecurity tools, enabling organizations to study attackers' methodologies and improve defensive strategies. The thesis concludes by underlining the necessity for continued research and innovation in honeypot technologies to stay ahead of evolving cyber threats.