aws/ap-south-1/cowrie-honeypotACTIVE

Live Telemetry & Ingress Traps COWRIE SSH

Real attacker traffic captured by the honeypot, classified by the ML pipeline, with automated blocking events overlaid on the timeline.

Auto-refresh 60s

Attack Velocity — Last 48 Hours

click a red or yellow marker for details

Attacker Behavior Mix

share of all sessions

Recent Events

latest 200 classified sessions

Timestamp (UTC)	Source IP	Behavior	Duration	Logins (try/ok)	Cmds	Session

High-Priority Sessions — Multi-Stage Attacker / Dropper

Session	Source IP	Duration	Cmds	Logins	Severity

telemetry/global-attack-surface

Global Attack Surface

Geographic origin of the most active attacker IPs (top 40 by session volume), resolved via IP geolocation and cached on the server.

Threat Origin Map

loading…

Marker size scales with session count. Red markers are IPs already blocked at the firewall; indigo markers are still active.

Top Threat Origins

share of mapped sessions

telemetry/analytics

Analytics

Behavioral breakdown, dwell time, login success and the defense posture across all captured sessions.

Attacker Behavior Breakdown

Top Attacker IPs

■ blocked ■ active

Average Session Dwell Time

seconds, by behavior

Login Success Rate

% of sessions, by behavior

Defense Coverage

blocked vs. active attacker IPs

Command Timing — Bot vs. Human-Like Pacing

Under 1 s average gap between commands = scripted execution. Slower pacing suggests deliberate or more sophisticated behavior.

Hourly Intensity Heatmap

UTC · sessions per hour · last 48 h of data

lowpeak

forensics/payloads-commands

Payloads & Commands

What attackers actually ran inside the fake shell, the credentials they tried, and every session flagged as a multi-stage dropper.

Most Frequent Commands

top 12

Command Inventory

pattern-tagged

Command	Count	Pattern

Top Usernames Tried

credential harvest

Top Passwords Tried

credential harvest

Dropper Sessions

Session	Source IP	Duration	Cmds	Logins	Status

forensics/session-explorer

Session Explorer

Browse, filter and inspect individual classified sessions. Click any row for the full record.

Timestamp (UTC)	Source IP	Behavior	Duration	Logins (try/ok)	Cmds	Session

forensics/ioc-blocklist

IOC Blocklist

IP addresses dropped at the firewall by the automated response layer, with the reason and trigger count.

Source IP	Reason	Trigger sessions	Blocked at (UTC)	Age

Blocking Policy

enforced via iptables DROP

Behavior	Trigger	Enforced by
Dropper	Any single command matching a payload-deployment pattern	Live log watcher (sub-second)
Cred-Stuff	3 or more sessions from the same IP	Scheduled job (every 10 min)
Recon	20 or more sessions from the same IP	Scheduled job (every 10 min)
Idle	30 or more sessions from the same IP	Scheduled job (every 10 min)
Probe / Scanner	Never blocked — one-off internet-wide scanners, kept for observation	—

system/model-summary

Model Summary

Unsupervised clustering discovers attacker behavior groups; a supervised classifier then labels new sessions in real time. Retrained weekly on all accumulated data.

Pipeline

Cowrie honeypot→ Feature extraction→ K-Means clustering↔ DBSCAN cross-check→ Random Forest classifier→ Auto-classify (10 min)→ Automated blocking→ Weekly retrain

K-Means vs DBSCAN — Cross-Validation

Two algorithms with different assumptions (centroid-based vs. density-based) landing on a similar cluster count is evidence the behavior groups are real structure in the data, not an artifact of one method. DBSCAN is evaluated on a ≤4,000-session sample because the host has limited RAM.

Cluster Separation Quality

Cluster Size Distribution

sessions per behavior

Classifier Reliability by Cluster

held-out test split

Cluster	Precision	Recall	F1	Test support	Reliability

Perfect scores are expected here because the classifier learns the clustering's own boundaries. Classes with very few test samples (e.g. the rare multi-stage cluster) are flagged because their metrics are not statistically reliable.

Automation Schedule

Component	Mechanism	Cadence
Cowrie honeypot	systemd service (auto-restart)	continuous
Live dropper watcher	systemd service, log tail + iptables	real time (< 1 s)
Session classification	cron · Random Forest	every 10 min
Threshold-based IP blocking	cron · iptables	every 10 min (+2)
Full retrain (extract → cluster → classify)	cron	weekly · Sun 03:00 UTC
Dashboard	Flask behind Nginx + TLS	continuous

system/about

About

Honeypot Network with ML-Based Attacker Profiling

Project

A live SSH/Telnet honeypot (Cowrie) deployed on AWS captures genuine internet attack traffic. Unsupervised (K-Means, DBSCAN) and supervised (Random Forest) machine learning automatically profile attacker behavior from real session data, without relying on stale public datasets, and an automated response layer blocks hostile IPs at the firewall.

Team

Dilrose Singh (2301196)
Feroz Firdoos (2301198)
Supervisor: Dr. Ankita Gupta

Tech Stack

CowriePythonPandasscikit-learnFlask Chart.jsLeafletAWS EC2NginxLet's Encryptsystemdcroniptables

Ethics & Safety

The honeypot is isolated on a dedicated cloud instance and only observes parties that probe it. No captured payload is ever executed, and blocking only affects inbound traffic to this server.