Well, the buncha windows instances running under a RAMd-up VMWARE server is pretty easy to cover (if a bit costly).

You'd probably want to run a couple of different versions of virus and spyware checkers (for variety) on the various Windows machines (not being much a Windows guy, I couldn't make any great suggestions here, but Norton, McAfee, etc come to mind).

The next part would be some sort of client to report back to a monitoring server the infection status of each box. You'd have to come up with a scale to determine level of infection, and (ideally) how the infection got there. From that point, you display everything on an NMS system of sorts. His graphic reminded me a lot of the OpenView screens we used to watch back in the late 90's, mostly for the randomness of the machine layouts and the interconnected lines.

After that, it's just a matter of how/where you display the NMS screen.

Could this whole thing be hosted in something like the Amazon S3 environment, allowing for many people to view the screen remotely?

Most virus scan software could be configured to report back to a central location. All you need to do is set it up so the client VM only detect and report but do not remove/clean. Then write a software to scan the monitoring log of the main station every 5 minutes for entry. The software will then do a lookup on either McAfee or Norton's virus library on everything that was detected and depending on the item's "threat level" it'll be visually represented differently.

Maybe each VM could be a tree and each spam email will be a leaf... each virus will be a fruit... any exploit will be a bug and something that's bad enough to kill it will be a snake... :D

http://www.honeynet.org/ http://www.honeyd.org/