Unlike traditional intrusion detection systems, honeypots do not rely on known attack signatures but instead detect anomalous behavior by recording any interaction with the decoys, and therefore can capture exploitation attempts of zero-day vulnerabilities.