Honeypots with

Attack Analytics

An enterprise-grade SOC platform for capturing, scoring, and visualizing live attacker behavior across multiple honeypot protocols

React + TypeScript • FastAPI • PostgreSQL • Cowrie & Dionaea • Docker

THE PROBLEM

Attacks happen in the dark

Most SOC teams see intrusion attempts only after the fact — scattered across raw logs with no scoring, no replay, and no way to tell noise from a real threat.

Fragmented logs

Honeypot events sit in raw JSON/text logs with no unified schema or ingestion pipeline.

No prioritization

Analysts can’t tell a routine scan from a critical reverse-shell attempt at a glance.

No visibility

Without live dashboards, teams learn about an attack hours or days after it started.

Manual reporting

Building daily/weekly attack summaries by hand doesn’t scale and invites inconsistency.

HONEYPOTS WITH ATTACK ANALYTICS

2

OBJECTIVES

What the platform sets out to do

Unify ingestion

One normalized API contract so any honeypot engine can feed the same pipeline.

Go real-time

WebSocket-driven dashboard and instant email alerts as attacks happen.

Score risk objectively

A weighted 0–100 engine that turns raw commands into LOW–CRITICAL verdicts.

Enrich with intelligence

Cross-reference attacker IPs against AbuseIPDB, VirusTotal, OTX and geolocation.

Replay every session

Reconstruct login → commands → file transfer → disconnect, step by step.

Report automatically

Daily/weekly/monthly PDF, Excel and CSV reports generated from one data source.

HONEYPOTS WITH ATTACK ANALYTICS

3

ARCHITECTURE

A clean, layered architecture

Every honeypot protocol flows through the same normalized ingestion contract — no new endpoints or dashboard widgets required per engine.

Presentation Layer

React + TypeScript SOC Dashboard

API Layer

FastAPI routers — app/api/v1/endpoints

Service Layer

Business logic — risk scoring, alerts, reports, threat intel

Repository Layer

Data access — app/repositories

Database

PostgreSQL — SQLAlchemy models, 8 Alembic migrations

HONEYPOT INTEGRATION

Cowrie (SSH/Telnet) and Dionaea (HTTP/FTP/SMB) each run a dedicated shipper that tails the engine’s native log, normalizes it, and POSTs to:

/api/v1/attacks/ingest

Cowrie shipper

SSH + Telnet sessions, commands, file up/downloads

Dionaea shipper

HTTP, FTP, SMB — one entity, three protocols

5 emulated ports: SSH 2222 • Telnet 2223 • HTTP 8080 • FTP 2121 • SMB 4450

HONEYPOTS WITH ATTACK ANALYTICS

4

TECHNOLOGY STACK

Built on a modern, production-grade stack

FRONTEND

React + TypeScript

Glassmorphic dark SOC dashboard, 12 route-level pages

Vite + Tailwind

Theme tokens drive an app-wide dark/light toggle

BACKEND

FastAPI

Versioned routers under app/api/v1/endpoints

PostgreSQL + SQLAlchemy

Alembic migrations, 8 revisions to date

INFRASTRUCTURE

Docker Compose

9 services orchestrated: db, backend, frontend, nginx, 2 honeypots, 2 shippers

Nginx

WebSocket-aware reverse proxy for the whole stack

HONEYPOTS WITH ATTACK ANALYTICS

5

PHASE 01

Core platform & SOC dashboard

A secure, role-aware foundation for every capability layered on top.

JWT authentication

Stateless, signed tokens secure every API call.

Role-based access control

Admin, Analyst and Viewer roles gate what each user can see and change.

Rate limiting

Protects ingestion and auth endpoints from abuse.

Audit-ready schema

Every record is structured for traceability and compliance review.

Glassmorphic SOC UI

Dark-first dashboard styled for long analyst shifts.

Live dashboard widgets

At-a-glance stat cards and status indicators on login.

HONEYPOTS WITH ATTACK ANALYTICS

6

PHASES 02–04

From login to live attack feed

Authentication, alerting and live updates work together so nothing waits for a page refresh.

01

Email authentication

Login by email; Forgot / Reset / Change Password; optional verification; Remember Me.

02

Real-time SMTP alerts

Gmail App Password, Mailtrap or any relay. HTML emails, dispatched in the background so ingestion never blocks.

03

WebSocket live feed

Authenticated live channel drives instant dashboard and Attack Monitor updates, plus a connection status indicator.

HONEYPOTS WITH ATTACK ANALYTICS

7

PHASES 05–06

Analytics and threat intelligence

Advanced Analytics

Attack heatmap across source geographies

Hourly, weekly and monthly attack trends

Risk distribution across all captured sessions

Session duration statistics

Top attacker commands, ranked

Threat Intelligence

Concurrent lookups against three providers, with 24h caching and graceful per-provider degradation if a key isn’t configured:

AbuseIPDB

VirusTotal

AlienVault OTX

Attacker geolocation

City, region, country, ISP and coordinates via ip-api.com — no API key required — with an embedded map inside the Threat Intel panel.

HONEYPOTS WITH ATTACK ANALYTICS

8

PHASE 07

A weighted risk scoring engine

Every session is scored 0–100 from the signals inside it — turning raw commands into an instant severity verdict.

Failed logins

SSH success

wget / curl

chmod

Reverse shells

Privilege escalation

weighted into a single 0–100 score

LOW

0–24

SCORE RANGE

MEDIUM

25–49

SCORE RANGE

HIGH

50–74

SCORE RANGE

CRITICAL

75–100

SCORE RANGE

HONEYPOTS WITH ATTACK ANALYTICS

9

PHASES 08–09

Replaying sessions, automating reports

ATTACK REPLAY

1

Login

2

Commands

3

Downloads

4

Uploads

5

Disconnect

Full session timeline with animated playback — reconstruct exactly what an attacker saw and typed.

AUTOMATED REPORTS

Daily

Weekly

Monthly

PDF

Excel

CSV

All three formats render from the same underlying data — they can never disagree.

12

development phases

all complete

HONEYPOTS WITH ATTACK ANALYTICS

10

PHASES 10–12

Search, notifications & live configuration

Advanced Search

Filter by IP, country, username, password, command, severity, date range or session reference — every filter combinable.

Notification Center

Persistent alert history with unread counts, mark-as-read, dismiss, and per-notification email delivery status.

Admin Settings

SMTP, admin email, notification threshold, session timeout and retention policy — all editable at runtime, no restart.

Encrypted-at-rest SMTP password • one-click "Run Retention Cleanup" • one-click "Send Test Email"

HONEYPOTS WITH ATTACK ANALYTICS

11

EXTENSIBILITY

One pipeline, many honeypot engines

Adding an engine means writing a shipper — not extending the backend. The schema, ingestion API and every dashboard widget already support it.

Cowrie

SSH / Telnet

DONE

Dionaea

HTTP / FTP / SMB

DONE

OpenCanary

DNS, RDP, MQTT, MySQL, MSSQL, PostgreSQL

PLANNED

Mailoney

SMTP

PLANNED

Conpot

ICS / Modbus

PLANNED

Recent fix: corrected the Dionaea log-shipping path and JSON schema, and taught the risk-scoring engine to recognize exploit/shellcode signatures and file transfers — with zero change to existing Cowrie scoring.

HONEYPOTS WITH ATTACK ANALYTICS

12

DEPLOYMENT

One command to stand it all up

Docker Compose stack

db (PostgreSQL)

backend (FastAPI)

frontend (React)

nginx (reverse proxy)

cowrie + cowrie-shipper

dionaea + dionaea-shipper

9 services total — up with docker compose up -d, down with docker compose down -v

End-to-end verification

verify_attacks.ps1 sends a benign test payload to each emulated protocol port, waits for the shippers to flush, then queries the backend and prints a pass/fail table:

SSH

port 2222

Telnet

port 2223

HTTP

port 8080

FTP

port 2121

SMB

port 4450

Runs automatically after setup.bat, or standalone anytime.

HONEYPOTS WITH ATTACK ANALYTICS

13

CONCLUSION

A complete, extensible SOC platform

All 12 planned phases are complete and verified end-to-end, with a proven pattern for adding new honeypot engines without touching the backend.

12

phases complete

5

protocols captured

3

threat-intel providers

NEXT STEPS

Ship OpenCanary, Mailoney and Conpot shippers

Move threat-intel API keys into the runtime Settings page

Extend RBAC with per-honeypot scoped permissions

Thank you

Questions welcome

HONEYPOTS WITH ATTACK ANALYTICS

14