Inspiration
Our team was interested in security and training our own ML/RL models. So we integrated them into 1 project.
What it does
GravityWell is a honeypot mesh. An attacker attaches to the port, and an LLM acts as a user on the machine in order to keep the attacker engaged. Everything the attacker does is logged and sent down a pipeline to a ML engine that is trained to recognize attacks and categorize them.
How we built it
- Honeypot: Python + Paramiko. A real SSH server that fakes a Linux shell
- LLM: Qwen2.5-Coder-0.5B, LoRA fine-tuned with Unsloth, served on CPU via Ollama/llama.cpp. Improvises shell output for commands the honeypot doesn't have canned.
- Collector API: Python + FastAPI + Pydantic. Receives one JSON event per login/command/logout, extracts IOCs, serves the dashboard.
- Database: SQLite (WAL): sessions, events, iocs, clusters.
- ML: PyTorch. Embeds and clusters sessions into attacker archetypes, projects them to 2D for the scatter plot.
- Frontend: React + Vite + Tailwind + shadcn/ui, React Router. Live session feed, terminal replay, cluster map.
- Infra: Docker Compose, four services, only the honeypot port exposed.
Challenges we ran into
Connecting each component to the next
Accomplishments that we're proud of
A trained and tuned LLM and ML engine
What we learned
Serving multiple areas with an API
What's next for GravityWell
Integrating a distributed system aspect
