Threat Detection Virtual honeypots do not exist as physical machines but populate network. Honeyd is a solution to create arbitrary virtual honeypots. Can pretend to be any operating system. Network based host identification tools are fooled. Can be installed on all unused network addresses Distraction Adversaries probe and try to break into machines that do not exist in a physical sense. Trend Detection Analysis of honeypot logs and network traffic allows us to detect new attacks and defend against them.