Abstract: Methods and systems are provided for emulating devices communicating over a network. In one example, the method includes scanning real network devices by sending a network traffic, recording the network responses from the real network devices, and deploying unikernel-based virtual machines based on the recorded network responses. The unikernel virtual machines may respond to an external network scan based on the fingerprint files and the service files generated from the recorded network responses.

Abstract: A method for emulating devices communicating over one or more networks includes intercepting and recording protocols used in communications between real network devices and statistically analyzing the recorded protocols. The method further includes developing, based on the statistical analysis, a behavioral specification for at least one master honeypot. In some examples, the development of the behavioral specification includes generating a Markov chain based on the statistical analysis, which is used to guide the probabilistic selection of properties of packets to be sent from the at least one master honeypot to at least one remote monkey honeypot. Each packet includes an unencrypted header and an encrypted payload, and each encrypted payload includes a response specification to be executed by the at least one remote monkey honeypot upon receipt of the packet from the at least one master honeypot.