box system to detect exploits, i.e., it does not use a signature of browser exploits to detect exploits. A Monkey Program, a single instance of the HoneyMonkey project, launches Internet Explorer to visit a site. It also records all registry and file read or write operations. The monkey does not allow pop-ups, nor does it allow installation of software. Any read or write that happens out of Internet Explorer's temporary folder therefore must have used browser exploits. These are then analyzed by malware detection programs and then manually analyzed. The monkey program then restarts the virtual machine to crawl another site in a fresh state. See also Client honeypot / honeyclient References MSR article MSR Technical Paper External links Security Now! PodCast - Episode #2: "HoneyMonkeys" eWeek articles: 1, 2 Honeyclient - An open source client honeypot that drives IE similar to HoneyMonkey HoneyC - A low interaction client honeypot framework Computer network security Microsoft Research