Skip to content
ENExplore Calculators

Honeypot Interaction Rate Calculator

Work out honeypot interaction rate instantly with clear inputs, formula shown and shareable results.

About Honeypot Interaction Rate Calculator

A honeypot has no legitimate users, so in principle every interaction is suspicious — which is what makes it the highest signal-to-noise detection available. In practice internal vulnerability scanners, asset discovery and monitoring probes generate benign hits, and excluding them is what preserves the purity that justifies deploying honeypots at all.

Formula

Honeypot signal

malicious = total interactions - known benign; purity = malicious / total; per honeypot = total / honeypot count

Worked example

With the default values below, Honeypot Interaction Rate Calculator returns Genuinely suspicious interactions per day of 420. Change any input above and every figure here is recalculated in your browser.

Inputs used

Honeypots deployedminimum 1
12
Interactions recorded per dayminimum 0
480
Unique source addressesminimum 0
210
Interactions from internal scannersminimum 0
60

Results

Genuinely suspicious interactions per day
420
Interactions per honeypot per day
40.0
Share of interactions that are suspicious
87.5%
Interactions per unique source
2.3

Step by step

  1. 1Values used
  2. 2Honeypot signal
  3. 3Genuinely suspicious interactions per day= 420
  4. 4Interactions per honeypot per day= 40.0
  5. 5Share of interactions that are suspicious= 87.5
  6. 6Interactions per unique source= 2.3

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why is honeypot signal so valuable?

Because there is no baseline of normal activity to filter. One interaction with an internal honeypot is stronger evidence than thousands of anomaly-based alerts.

How should scanners be excluded?

Allow-list your scanner source addresses at the honeypot rather than filtering downstream, so the alert pipeline stays clean and the purity metric stays meaningful.

Related Calculators

Honeypot Interaction Rate Calculator | Calcrivo