AI Honeypot and Threat Intelligence Dashboard

AI-driven deception honeypot that captures, analyzes, and visualizes cyber threats in a controlled campus environment using machine learning and threat intelligence.

Comment

Inspiration

College networks are increasingly exposed to suspicious login attempts, command execution, and other malicious activities. Traditional cybersecurity labs often depend on static datasets, which limits practical exposure to real-time attack behavior.

We wanted to build a safe environment where suspicious activity could be captured, analyzed, and visualized without affecting a real production system. This led us to develop HoneySentinel, a deception-based honeypot and threat intelligence platform for controlled campus-network environments.

What it does

HoneySentinel uses Cowrie as an SSH honeypot to capture attacker interactions such as login attempts, commands, sessions, and attack events.

The captured activity is forwarded to a Spring Boot backend and stored in MySQL. Commands are analyzed using a hybrid Rule-Based + Logistic Regression machine learning engine. The system provides threat categories, severity levels, risk scores, MITRE ATT&CK mappings, and security recommendations.

All this information is presented through a centralized React-based SOC dashboard, allowing authorized users to monitor and analyze the captured activity from a single interface.

How we built it

The system combines several technologies:

  • Cowrie and Kali Linux for the SSH honeypot
  • Python for log forwarding and AI/ML processing
  • Spring Boot for backend services and API Gateway
  • MySQL for persistent security data
  • Flask and Scikit-learn for the AI threat engine
  • Logistic Regression for command classification
  • React and Vite for the SOC dashboard
  • MITRE ATT&CK for threat technique mapping

The overall pipeline is:

Attacker → Cowrie → cowrie.json → Python Log Forwarder → Spring Boot → MySQL → AI/ML Analysis → API Gateway → React SOC Dashboard

Challenges we faced

One of the major challenges was integrating the different components into a single end-to-end pipeline. Cowrie generates security events in its own JSON format, so we had to develop a forwarding mechanism to transform and send the required information to the backend.

We also had to coordinate services running across Windows and Kali Linux, connect the backend with MySQL, integrate the AI service with the rest of the application, and make the dashboard display live security information consistently.

Another challenge was developing an ML classifier with a relatively small labeled dataset while ensuring that known security-sensitive commands could still be handled deterministically. We addressed this using a hybrid Rule-Based + Logistic Regression approach.

Accomplishments

We successfully integrated the major components into an end-to-end working prototype.

The current system includes:

  • SSH honeypot deployment using Cowrie
  • Real-time-style attack log collection and forwarding
  • Persistent MySQL storage
  • Spring Boot backend services
  • Centralized API Gateway
  • AI-based command threat classification
  • MITRE ATT&CK technique mapping
  • Severity and risk scoring
  • Security recommendations
  • Centralized React SOC dashboard
  • PDF security report generation

The current Logistic Regression model achieved 90% test accuracy on a dataset containing 250 labeled samples across 10 threat categories.

What we learned

Through this project, we gained practical experience in honeypot deployment, cybersecurity monitoring, REST API integration, backend development, database design, machine learning, and frontend development.

We also learned how important end-to-end integration is when building a cybersecurity platform. A useful security system requires not only an ML model, but also reliable data collection, storage, analysis, visualization, and clear interpretation of the results.

What's next

We plan to improve HoneySentinel by:

  • Expanding the training dataset
  • Introducing continuous model retraining
  • Adding advanced anomaly detection
  • Supporting additional honeypot protocols such as HTTP, FTP, and Telnet
  • Integrating external threat intelligence
  • Supporting SIEM integration
  • Deploying distributed honeypot nodes
  • Exploring automated response mechanisms

Built With

Share this project:

Updates

Submission history