Intelligent Honeypot for Behavioural Threat Profiling

Inspiration

This project is inspired by the need to shift from reactive cybersecurity to Active Deception. By creating a "vulnerable-looking" decoy that mimics developer errors, we preemptively engage threats to protect actual production assets.

What it does

The system uses Behavioral Tracking to separate bots from humans via keystroke timing and Strategic Friction to test attacker persistence. It also deploys Honeytokens, which are invisible code-level links that identify intruders actively probing the website's source.

How we built it

The prototype uses a Python (Flask) backend to manage simulated server errors and a JavaScript layer to calculate keystroke intervals. An SQLite database categorizes attacker intent based on their interactions with fake "sensitive" dashboard elements.

Challenges we ran into

The primary challenge was solving the "Trust Problem" to ensure the decoy appeared as a legitimate developer oversight rather than an obvious trap. We addressed this by subtly hiding honeytokens within CSS and source comments to increase the perceived authenticity of the vulnerability.

Accomplishments that we're proud of

We successfully designed a Zero-False-Positive system where regular users are never trapped because they do not interact with hidden code. We also developed an Adaptive Logic flow that transitions from server errors to access based on the attacker's persistence.

What we learned

The research focused on the psychological aspects of cybersecurity. We learned to implement "Active Deception" and basic web routing in Python to transform a standard interface into a proactive security tool.

What's next for Intelligent Honeypot for Behavioural Threat Profiling

Future iterations involve integrating LLMs to generate randomized, realistic server logs and developing an Automated Firewall Link to instantly block captured IP addresses from the production system.

Built With

• css3
• html5
• javascript
• python
• sqlite