Abstract: A method for emulating devices communicating over one or more networks includes intercepting and recording protocols used in communications between real network devices and statistically analyzing the recorded protocols. The method further includes developing, based on the statistical analysis, a behavioral specification for at least one master honeypot. In some examples, the development of the behavioral specification includes generating a Markov chain based on the statistical analysis, which is used to guide the probabilistic selection of properties of packets to be sent from the at least one master honeypot to at least one remote monkey honeypot. Each packet includes an unencrypted header and an encrypted payload, and each encrypted payload includes a response specification to be executed by the at least one remote monkey honeypot upon receipt of the packet from the at least one master honeypot.