One related technique that is not demonstrated in this chapter, but is worth mentioning, is sandboxing. Sandboxing serves a different purpose from a honeypot, but they both make an effort to create an environment that looks legitimate, but is actually tightly controlled and monitored. An example of sandboxing is the creation of a virtual machine with no network connectivity, which logs all file changes and attempted network connections to see if anything suspicious happens.
Sometimes, a sandbox environment can be detected by looking at the number of CPUs and the RAM. If the malicious application detects a system with a small amount of resources, say 1 CPU and 1 GB RAM, then it is likely not to be a modern desktop machine and may be a sandbox. Malicious software writers have learned to fingerprint sandbox environments and program the application to bypass any malicious...