Minerva
Distinguishes real network services from honeypot emulators by analyzing statistical fingerprints of TCP response times.
Distinguishes real network services from honeypot emulators by analyzing statistical fingerprints of TCP response times.
Minerva is a sophisticated honeypot detection tool designed to identify synthetic services masquerading as legitimate ones on a network. By analyzing the round-trip time measurements of TCP responses, it constructs a statistical fingerprint that reveals subtle timing patterns indicative of emulation. Real services exhibit natural variations due to operating system scheduling and network jitter, while honeypots like Cowrie or Dionaea often betray their artificial nature through unnaturally uniform responses, delayed initial handshakes, or bimodal timing distributions. Minerva processes these timing samples to deliver a verdict, a probability score, and specific indicators that highlight the tell-tale signs of a honeypot, integrating seamlessly into network security and automated defense platforms.