ShadowNet: A Multi-Protocol IoT Honeypot for Attack Detection and Behavior Analysis
Abstract
The rapid growth of Internet of Things (IoT) devices in smart homes, industries, and urban infrastructure has increased the global cyber-attack surface. Many IoT devices use lightweight communication protocols and often lack strong authentication, making them easy targets for automated cyberattacks. This paper introduces ShadowNet, a virtual IoT honeypot framework designed to capture and study malicious interactions in IoT environments. The system simulates various IoT communication services, including HTTP, SSH, and MQTT, letting attackers interact with it as if it were a real vulnerable IoT device. The framework records attacker behavior, such as login attempts, command execution, payload injections, and request metadata. To improve attack identification, the system uses a Random Forest-based machine learning model to classify network traffic as normal or malicious based on activity patterns. A web-based monitoring dashboard also visualizes attack statistics and intrusion activity by protocol. In experimental deployments, the framework captured multiple attack patterns, including SSH brute-force attempts, HTTP credential stuffing, and malicious MQTT payload injections. This shows the effectiveness of honeypot-based monitoring paired with machine learning techniques, achieving high accuracy in detecting malicious IoT traffic. The proposed system offers a scalable and cost-effective solution for real-time IoT security monitoring.