Abstract—The great popularity of the Internet increases the
concern for the safety of its users as many malicious Web pages
pop up in daily basis. Client honeypots are tools, which are
able to detect malicious Web pages, which aim to infect their
visitors. These tools are widely used by researchers and anti-virus
companies in their attempt to protect Internet users from being
infected. Unfortunately, cyber-criminals are becoming aware of
this type of detection and create evasion techniques that allow
them to behave in a benign way when they feel to be threatened.
This bi-faceted behavior enables them to operate for a longer
period, which translates in more profit. Hence, these deceptive
Web pages pose a significant challenge to existing client honeypot
approaches, making them incapable to detect them when exhibit
the aforementioned behavior.