Question

What is the purpose of a shadow honeypot?

(a) To flag attacks against known vulnerabilities

(b) To help reduce false positives in a signature-based IDS

(c) To randomly check suspicious traffic identified by an anomaly detection system

(d) To enhance the accuracy of a traditional honeypot

I have been asked this question in an interview for job.

My enquiry is from Intrusion Detection Systems in chapter Point to Point Protocol & Error Detection of Computer Network

Answer 1

Correct answer is (c) To randomly check suspicious traffic identified by an anomaly detection system

The best I can explain: “Shadow honeypots,” as researchers call them, share all the same characteristics of protected applications running on both the server and client side of a network and operate in conjunction with an ADS.