Presentation on Client-Side Honeypots

The basic idea of this thesis is to combine a component that drives Internet Explorer or other client-side applications (Word, PowerPoint, Winamp, Photoshop, ...) with CWSandbox. CWSandbox monitors the application in real-time and detects suspicious activities like creation of files, new processes, new registry keys, or similar activities. That way, information about client-side exploits can be captured - something that is not possible with regular, server-based honeypots.