Detecting suspicious activity on remote desktop protocols using Honeypot system

摘要

This article is devoted to the effectiveness of security systems using Honeypot technology. There are studied basic structures of security systems, which use Honeypot technology. There is described developing process of a “trap” for VNC/RDP protocols, which main goal is to emulate remote desktops. Assembled “trap” will identify the attacker to collect information about his actions by analyzing malicious traffic (Honeypot resource allows to collect only malicious traffic unlike firewall which gathers all the traffic).