Lightscope: Turning Production Machines into Telescopes and Honeypots#

Authors: Eric Kapitanski, Jelena Mirkovic (USC Information Sciences Institute)

• Why: A genuinely new vantage point for Internet security measurement. The insight — attackers avoid known dark-space sensors and behave differently toward production endpoints — means your own production fleet is an underused sensor, and this work proves it quantitatively.
• What: LightScope, a lightweight application that unifies passive Layer-4 observation with selective proxying to a remote Layer-7 honeypot, running on unused ports of production servers. Two months of data from 235 deployments shows scanner populations, port-targeting profiles, and post-login behaviors only partially visible from dark-space telescopes and honeynets — including 64,686 scanners observed by LightScope and no other vantage point. (from abstract only)
• How: Embeds measurement on production hosts themselves, using a subset of unused ports; selective L7 proxying to a remote honeypot captures post-exploit behavior without putting production at risk.
• Where applicable: Any production fleet with unused ports — broadly applicable technique, not org-specific. Worth understanding even if you never deploy it, because it changes how you interpret coverage gaps in your own threat telemetry.