LightScope
Cite LightScope
If you use LightScope, its data, or its results, please cite our ACM IMC 2026 paper.
ACM reference
Eric Kapitanski and Jelena Mirkovic. 2026. LightScope: Turning Production Machines into Telescopes and Honeypots. In Proceedings of the 2026 ACM Internet Measurement Conference (IMC '26), October 12–16, 2026, Karlsruhe, Germany. ACM, New York, NY, USA, 18 pages. https://doi.org/10.1145/3777912.3839790
BibTeX
@inproceedings{10.1145/3777912.3839790,
author = {Kapitanski, Eric and Mirkovic, Jelena},
title = {Lightscope: Turning Production Machines into Telescopes and Honeypots},
year = {2026},
isbn = {9798400723278},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3777912.3839790},
doi = {10.1145/3777912.3839790},
abstract = {Traffic to unused IP addresses (dark spaces), including passive and reactive network telescopes and honeynets, has traditionally been used to study malicious activities. However, attackers may avoid known dark space sensors and preferentially target endpoints hosting legitimate services. We present LightScope, a lightweight application that unifies passive observation at Layer 4 with selective proxying to a remote Layer 7 honeypot. LightScope does this by leveraging a subset of the unused ports on production servers. By embedding measurement on the production hosts themselves, LightScope creates a new vantage point for observing various scanner populations, port-targeting profiles, and post-login behaviors that are only partially visible from dark-space telescopes and honeynets. In this paper we analyze two months of data collected from 235 LightScope deployments. We show that LightScope contributes new knowledge about widely observed scanners, their port scan strategies and their post-exploit activities. These scanners interact with production endpoints running LightScope differently than they do with other vantage points. In our study period, LightScope also exclusively observes 64,686 scanners not present at other vantage points. By instrumenting production machines, LightScope provides complementary visibility to existing telescopes and honeynets.},
booktitle = {Proceedings of the 2026 ACM Internet Measurement Conference},
pages = {228–245},
numpages = {18},
keywords = {telescope, scan monitoring, honeypot, malicious activity, threat intelligence, cyber deception},
location = {Karlsruhe Institute of Technology, Karlsruhe, Germany},
series = {IMC '26}
}