Honeypot-Based Information Monitoring, Detection, Response and Protection System
Maksym Prodeus, Андрій Олександрович Нічепорук, Antonina Kashtalian · Central Ukrainian Scientific Bulletin Technical Sciences · 2025
The increasing complexity of cyber threats poses significant challenges to existing security measures, which often fail to provide sufficient protection. This paper presents an approach to improving cybersecurity through honeypot-based techniques. The study focuses on the development and deployment of decoy files designed to detect unauthorized access attempts and monitor malicious activities. Honeypots play a crucial role in identifying various attack types, including insider threats and masquerade attacks, which traditional security systems often overlook. The paper also discusses the integration of honeypots into comprehensive security frameworks, examining their optimal use cases and effectiveness in real-world applications. The research explores the design and implementation of an advanced honeypot framework that enhances threat detection and response. The proposed system utilizes dynamic decoy files, which change metadata and content to maintain authenticity and attract malicious actors. Various triggers, such as file access, modification, and unauthorized copying, are employed to detect suspicious behavior. The study also evaluates the effectiveness of automated response mechanisms, including IP blocking and real-time monitoring. The framework's performance is analyzed through experimental deployment across different IT environments, highlighting its advantages over traditional static honeypots. Key performance indicators, including detection accuracy, response time, and false positive rates, are assessed to validate the system's reliability. The results demonstrate that the proposed honeypot-based system significantly improves threat detection and response capabilities while minimizing false alarms. The integration of dynamic honeypots into corporate cybersecurity infrastructures enhances resilience against cyberattacks, including ransomware and advanced persistent threats. However, certain limitations, such as the inability to detect memory-only malware and highly obfuscated threats, remain challenges for future research. The study concludes that adaptive honeypot strategies, combined with automated threat intelligence, can substantially enhance modern cybersecurity defense mechanisms.