Optimizing Internet of Things Honeypots with Machine Learning: A Review

Stefanie Lanz, Sarah Lily-Rose Pignol, Patrick Schmitt, Haochen Wang, Maria Papaioannou, Gaurav Choudhary, Nicola Dragoni

The increasing use of Internet of Things (IoT) devices has led to growing security concerns, necessitating advanced solutions to address emerging threats. Honeypots enhance IoT security by attracting and analyzing attackers. However, traditional honeypots struggle with adaptability and efficiency. This paper examines how machine learning enhances honeypot capabilities by improving threat detection and response mechanisms. A systematic literature review using the snowballing method explores the application of supervised, unsupervised, and reinforcement learning. Various classifiers for machine learning are analyzed to optimize honeypot architectures. This paper focuses on two types of honeypots: dynamic honeypots, which evolve to mislead attackers, and adaptive honeypots, which respond to threats in real time. By evaluating low-interaction, high-interaction, and hybrid honeypots, we determine how different machine learning techniques enhance detection and resource efficiency. Key findings include improved detection rates, with machine learning techniques, particularly supervised learning models like random forest, significantly enhancing detection accuracy, achieving up to 0.96 accuracy. Adaptive honeypots utilizing machine learning demonstrate better resource management, reducing false positives and optimizing computational resources. Despite these improvements, high computational demands and limited real-world testing hinder widespread adoption in IoT environments. This paper provides an overview of current trends, identifies research gaps, and offers insights for developing more intelligent IoT honeypots. There is no doubt that machine learning can help create more resilient and adaptive security solutions for IoT networks.