June 9, 2019
Publications
>
Article

Enabling an Anatomic View to Investigate Honeypot Systems: A Survey

Publicated to: IEEE Systems Journal. 12 (4): 3906-3919 - 2018-12-01 12(4), DOI: 10.1109/JSYST.2017.2762161

Authors:

Fan, WJ; Du, ZH; Fernández, D; Villagrá, VA
[+]

Affiliations

Tsinghua Univ, Dept Comp Sci & Technol, Tsinghua Natl Lab Informat Sci & Technol, Beijing 100084, Peoples R China - Author
Univ Kent, Sch Comp, Canterbury CT2 7NZ, Kent, England - Author
Univ Politecn Madrid, Dept Telemat Engn, E-28040 Madrid, Spain - Author
See more

Abstract

A honeypot is a type of security facility deliberately created to be probed, attacked, and compromised. It is often used for protecting production systems by detecting and deflecting unauthorized accesses. It is also useful for investigating the behavior of attackers, and in particular, unknown attacks. For the past 17 years plenty of effort has been invested in the research and development of honeypot techniques, and they have evolved to be an increasingly powerful means of defending against the creations of the blackhat community. In this paper, by studying a wide set of honeypots, the two essential elements of honeypots-the decoy and the captor-are captured and presented, together with two abstract organizational forms-independent and cooperative-where these two elements can be integrated. A novel decoy and captor (D-C) based taxonomy is proposed for the purpose of studying and classifying the various honeypot techniques. An extensive set of independent and cooperative honeypot projects and research that cover these techniques is surveyed under the taxonomy framework. Furthermore, two subsets of features from the taxonomy are identified, which can greatly influence the honeypot performances. These two subsets of features are applied to a number of typical independent and cooperative honeypots separately in order to validate the taxonomy and predict the honeypot development trends.
[+]

Keywords

Computer securityCouplingsFansHoneypotsIntrusion detectionMonitoringNetwork securityResearch and developmentSecureSecurityTaxonomyTerminologyVirtualization

Quality index

Bibliometric impact. Analysis of the contribution and dissemination channel

The work has been published in the journal IEEE Systems Journal due to its progression and the good impact it has achieved in recent years, according to the agency WoS (JCR), it has become a reference in its field. In the year of publication of the work, 2018, it was in position 6/84, thus managing to position itself as a Q1 (Primer Cuartil), in the category Operations Research & Management Science. Notably, the journal is positioned above the 90th percentile.

From a relative perspective, and based on the normalized impact indicator calculated from World Citations provided by WoS (ESI, Clarivate), it yields a value for the citation normalization relative to the expected citation rate of: 2.4. This indicates that, compared to works in the same discipline and in the same year of publication, it ranks as a work cited above average. (source consulted: ESI Nov 13, 2025)

This information is reinforced by other indicators of the same type, which, although dynamic over time and dependent on the set of average global citations at the time of their calculation, consistently position the work at some point among the top 50% most cited in its field:

  • Weighted Average of Normalized Impact by the Scopus agency: 2.74 (source consulted: FECYT Mar 2025)

Specifically, and according to different indexing agencies, this work has accumulated citations as of 2026-04-24, the following number of citations:

  • WoS: 52
  • Scopus: 72
  • Google Scholar: 111
[+]

Impact and social visibility

From the perspective of influence or social adoption, and based on metrics associated with mentions and interactions provided by agencies specializing in calculating the so-called "Alternative or Social Metrics," we can highlight as of 2026-04-24:

  • The use, from an academic perspective evidenced by the Altmetric agency indicator referring to aggregations made by the personal bibliographic manager Mendeley, gives us a total of: 137.
  • The use of this contribution in bookmarks, code forks, additions to favorite lists for recurrent reading, as well as general views, indicates that someone is using the publication as a basis for their current work. This may be a notable indicator of future more formal and academic citations. This claim is supported by the result of the "Capture" indicator, which yields a total of: 136 (PlumX).

With a more dissemination-oriented intent and targeting more general audiences, we can observe other more global scores such as:

  • The Total Score from Altmetric: 9.
  • The number of mentions on the social network X (formerly Twitter): 3 (Altmetric).

It is essential to present evidence supporting full alignment with institutional principles and guidelines on Open Science and the Conservation and Dissemination of Intellectual Heritage. A clear example of this is:

  • The work has been submitted to a journal whose editorial policy allows open Open Access publication.
  • Assignment of a Handle/URN as an identifier within the deposit in the Institutional Repository: https://oa.upm.es/45563/

As a result of the publication of the work in the institutional repository, statistical usage data has been obtained that reflects its impact. In terms of dissemination, we can state that, as of

  • Views: 494
  • Downloads: 1,237
[+]

Leadership analysis of institutional authors

This work has been carried out with international collaboration, specifically with researchers from: China; United Kingdom.

There is a significant leadership presence as some of the institution’s authors appear as the first or last signer, detailed as follows: Last Author (VILLAGRA GONZALEZ, VICTOR ABRAHAM).

[+]

Awards linked to the item

This work was supported in part by the National Key Research and Development Program of China under Grant 2016YFB1000602 and Grant 2017YFB0701501, in part by the MOE Research Center for Online Education Foundation under Grant 2016ZD302, and in part by the National Natural Science Foundation of China under Grant 61440057 and Grant 61363019.
[+]