Evaluation of Reinforcement Learning Algorithm on SSH Honeypot

The honeypot is a tool to detect the attacker's activity and can be used as a diversion. But the growth of attacking techniques makes the attacker realize they are interacting with a honeypot, not a real server. Previous research discusses the concept of an adaptive honeypot to make the honeypot more adaptive to the attacker because the growth of cyber attack techniques make attacker realize the presence of the honeypot. To realize the idea, researchers combine the honeypot with the reinforcement learning (RL) algorithm to create a honeypot that can learn from attacker behavior. In this research, we measure the impact of the RL algorithm on the SSH honeypot. The result is that the attacker and honeypot interaction is longer than before.