Advanced Cyber Deception
Traditional security relies on perimeter walls. Deception technology assumes the breach has already occurred. By deploying Honeypots (decoys) and Honeynets (decoy networks), defenders shift from passive defense to active intelligence gathering.
The Honeypot
A single decoy system with no production value. Any interaction is unauthorized by definition. It acts as a high-fidelity alarm system with zero false positives.
The Honeynet
A network of honeypots simulating a complex environment (e.g., DMZ, Database Clusters). Used to analyze lateral movement and attacker strategy within a network.
The Spectrum of Interaction
Not all honeypots are created equal. We categorize them by "Interaction Level"—how much freedom the attacker has. This interactive chart visualizes the trade-off between the risk of deployment, the cost to maintain, and the fidelity (quality) of intelligence gathered.
Low Interaction
Service emulation only (e.g., Port 80 listening). Safe, easy, but easy to fingerprint. Good for statistical scanning data.
Medium Interaction
OS Emulation. The "Goldilocks" zone. Captures shell commands and file downloads without a real OS kernel.
High Interaction
Real OS heavily monitored. High risk of compromise, high maintenance, but captures zero-days and rootkits.
From Data to Intelligence
Raw logs are just data. Threat Intelligence (TI) is the analysis of that data to understand the "Who, Why, and How." Honeypots are unique because they generate data with near-zero false positives.
The Pyramid of Pain (Simplified)
Click a layer to reveal details
Select a Layer
Click on the pyramid layers to understand different Indicators of Compromise (IOCs) collected by honeypots.
Tactical vs. Strategic TI
"Block IP 192.168.1.5 immediately because it attacked the SSH honeypot."
"We are seeing a 400% increase in IoT attacks using default credentials. We need to audit all camera passwords."
Medium Interaction Simulation
Medium interaction honeypots like Cowrie simulate an SSH session. They don't have a real kernel; they are Python scripts pretending to be an OS.
Task: Act as the attacker. Use the terminal below to explore the "compromised" system. Try standard Linux commands like ls, help, whoami, or cat /etc/passwd.
Note: This is a JavaScript emulation of the Python logic presented in Example 3 of the lecture.
Tactical Analysis: Log Parsing
In Real-Life Example 2, we used a Bash script to extract attacker IPs from raw logs. This interactive module demonstrates that process: filtering noise to find the signal (Tactical TI).
Ready to extract Tactical Intelligence.
Legal Considerations
Remember the "Golden Rule" of active defense: Monitor, but do not hack back. Tracing an attacker is allowed; attacking their infrastructure is illegal. Ensure Egress Filtering is enabled to prevent your honeypot from being used to attack others. Reference: Electronic Frontier Foundation (EFF).