Defense of the Clones: Securing Web Applications with Automatic Honeypot Generation and Deployment

In this paper, we introduce PARALLAX, an automatic, application-agnostic, and resource-efficient web application honeypot generation and deployment framework. PARALLAX can generate honeypot clones of any live LAMP stack, without interfering with the availability of the web application, and deploys the clones alongside the original web application. In the PARALLAX-based network deployment, all attackers are seamlessly and covertly redirected to the honeypot clone, while benign visitors may continue their interaction with the original web application, same as before. Alongside PARALLAX, we introduce three independent sensitive data detection schemes, which we employ to isolate and replace the sensitive data of the original web application on the honeypot clone. As we allow attackers full interaction with all parts of the honeypot clone, we replace the sensitive data on the honeypot with realistic, context-aware, synthetic data using an LLM to ensure that none of the sensitive data of the original web application are compromised by attackers. To evaluate PARALLAX, we deploy it in the wild for five open-source web applications, and we examine the honeypot generation and deployment performance, as well as the interaction of attackers with the honeypot clones. Lastly, to evaluate the deceptive capability of the synthetically generated data, we conduct a large-scale user study and evaluate how well humans are able to differentiate between real and synthetic sensitive data.