A Modular Multi-Service Honeypot for Multi-Protocol Attack Observation and Threat Intelligence Generation

Abstract

Signature-based defenses have been found to be increasingly ineffective due to today’s sophisticated cyber attacks which include automation, credential guessing through brute force, web application vulnerabilities, and attacks on standard network protocols. The problem is, therefore, how attackers can be lured in order to analyze their techniques without putting enterprise infrastructure at risk. Honeypots address this problem. This paper presents a modular, multi-service honeypot designed for deception and simulating eight target protocols. HTTP (60.1% of events) was the principal target attacked, followed by SSH-like bruteforcing (25.5%). The most common activities were directory scanning, injection attempts, and credential-stuffing. The analysis of the collected telemetry indicated multi-stage attack sequences from recon to exploitation. Mapping events to the MITRE ATT&CK framework showed good coverage of techniques such as T1190 (Exploit Public-Facing Application), T1110 (Brute Force) and T1059 (Command and Scripting Interpreter).The results demonstrate that a safely contained, multi-protocol honeypot can generate reproducible, structured threat intelligence suitable for both security research and operational defense.