Sentinel Deception Grid: ZK Threat Intel

Trap hackers with edge honeypots and securely share threat intelligence globally using Midnight's ZK-proofs, protecting enterprise privacy while building collective defense.

Comment

About the project

Inspiration

In today’s cybersecurity landscape, threat intelligence sharing is fundamentally broken. Organizations are constantly under attack, but sharing the IP addresses or payloads of their attackers is a massive risk. Sharing this data can expose internal network topologies, reveal unpatched vulnerabilities, or inadvertently act as a public admission of a breach. We were inspired to fix this trust deficit. We asked ourselves: How can organizations collaboratively share threat intelligence and defend each other, without ever exposing their private data?

What it does

Sentinel Deception Grid is a full-stack, privacy-preserving "Honeypot-as-a-Service".

  1. The Trap: It deploys isolated network decoys (like SSH, RDP, and WordPress servers) at the edge of an organization's network to attract and trap attackers.
  2. The Analysis: It captures attacker movements in real-time, streaming their payloads and IP addresses to a centralized threat dashboard.
  3. The Midnight Integration: Using the Midnight Blockchain, Sentinel takes malicious threat indicators and attests them to a global smart contract using Zero-Knowledge Proofs (ZKPs). This allows organizations to cryptographically prove that an IP is malicious and build community consensus (a "Corroboration Score"), all while keeping their actual network data completely hidden.

How we built it

We built a highly scalable event-driven architecture that bridges Web2 infrastructure with Web3 ZK technology:

  • Sensors: We containerized multiple honeypots (Cowrie for SSH/Telnet, customized RDP, and WordPress decoys) using Docker.
  • Data Pipeline: Filebeat tails the honeypot logs and streams them to an Apache Kafka event bus.
  • Backend: A Python FastAPI service consumes the Kafka streams, normalizes the threat data, stores it in PostgreSQL, and serves it to the frontend via REST APIs and WebSockets.
  • Frontend: A sleek, dynamic React / Vite dashboard visualizes the active attacks and provides the Operator Console.
  • Blockchain Bridge: We built a Node.js midnight-bridge service. We wrote a custom smart contract (defenseLedger) in the Compact language and compiled it for the Midnight Network. Using the @midnight-ntwrk SDKs, our bridge signs and submits transactions to the Midnight Preview testnet.

Challenges we ran into

Integrating a cutting-edge ZK blockchain into a real-time event pipeline presented several unique challenges:

  1. Wallet Synchronization: Because the Midnight testkit uses InMemoryTransactionHistoryStorage, the wallet must sync the entire chain history from genesis upon startup. We had to carefully decouple our Express.js API endpoints from the wallet initialization to prevent the bridge from blocking during the 15-minute sync.
  2. Dust UTXO Management: We encountered Wallet.InsufficientFunds errors even when the wallet had a high balance of tNight tokens. We learned that Midnight requires specialized "dust UTXOs" for transaction fees, requiring us to implement a pre-flight dust generation routine before the contract could be deployed.
  3. State Management: Bridging the asynchronous nature of blockchain consensus with the real-time expectations of a React dashboard required careful state handling.

Accomplishments that we're proud of

We successfully bridged a high-throughput Web2 data pipeline (Kafka) with a privacy-preserving Web3 ledger (Midnight). We took a complex cybersecurity concept (ZK threat sharing) and packaged it into a beautiful, user-friendly SaaS platform that works end-to-end.

What we learned

We gained deep hands-on experience with the Compact smart contract language and the intricacies of UTXO-based zero-knowledge blockchains. We also learned how to orchestrate complex microservices (Kafka, Zookeeper, Postgres, FastAPI, Node.js) into a unified application stack.

What's next for Sentinel Deception Grid

  1. Broader Decoy Support: Adding support for ICS/SCADA and IoT honeypots to protect critical infrastructure.
  2. Automated Defense: Expanding the Compact smart contract so firewalls can automatically subscribe to the Midnight ledger and block IPs that reach a certain ZK-verified corroboration threshold.

Built With

Share this project:

Updates