Abstract
As the number of cyber threats continues to rise and grow more sophisticated, organizations must find new ways to understand and counteract attacker behavior. This thesis compares the actions of attackers across three different setups: a machine with no deception mechanisms, a machine with a low-interaction honeypot, and a machine with a high interaction honeypot. By recording activity over several weeks and building profiles foreach attacker based on their IP address, clear differences in behavior between the systems were identified. Based on these observations, the work proposes new strategies for designing honeypots that are more effective at gathering intelligence and understanding attackers’ motives. This thesis also explores how these deception tools can be integrated into Zero Trust Networks to help organizations remain resilient against future attacks.