Definition of attack in the context of low-level interaction server honeypots

Abstract

Honeypots play an important role in network security, since they obtain information about attackers, their targets, methods, and tools. This paper offers a discussion about the definition of attack. The main matter of discuss is when an activity is considered to be an attack. Paper only focuses on low-level interaction server honeypots and outlines the definition of attack from the perspective of windows service emulation and Linux SSH services emulation.