Using Honeyclients to Detect Malicious Websites

Using malicious sites to launch attacks against client user applications is a growing threat in recent years. This led to emergence of new technologies to counter and detect this type of client-side attacks. One of these technologies is honeyclient. Honeyclients crawl the Internet to find and identify web servers that exploit client-side vulnerabilities. In this paper, we address honeyclients by studying and analyzing low and high interactive honeyclients. We introduce comparison attributes to evaluate honeyclients, and applying them to compare among HoneyC and Capture as examples on each type. Moreover, we present some techniques can be used by malicious websites to counter and fingerprint honeyclients, and we make recommendations to overcome these evasion techniques.