HoneyO: an open-source Kubernetes based Honeynet for advanced attacker characterization
Rafael José Santos Simões · Portuguese National Funding Agency for Science, Research and Technology (RCAAP Project by FCT) · 2024
As digital infrastructure expands, cybersecurity faces increasingly severe threats, emphasizing the need for effective defense strategies. Honeynets, simulated environments designed to attract and study attacker, are essential tools in proactive cyber defense. However, current solutions often lack flexibility, scalability, and sufficient interaction, limiting their effectiveness in today’s dynamic security landscape. This project introduces an innovative, open-source honeynet solution that overcomes these limitations with a modular and adaptable architecture utilizing microservices and Kubernetes. Key features of this solution include dynamic configuration with easily adjustable settings to respond to different threats, enhanced interaction that captures detailed and sophisticated attack data, service mirroring to improve attacker engagement by replicating production services, dynamic honeypot management that automatically creates and removes honeypots to isolate attack sessions, and uniform monitorization mechanisms for better data analysis. Designed for cloud deployment, the system seamlessly integrates with existing resources and uses Kubernetes to efficiently manage honeypot instances across the network. This approach allows the honeynet to capture high quality indicators of compromise (IOCs) and provide valuable insights into attack methods and techniques while minimizing the risk of detection. Key findings from this research include improved data quality and the ability to dynamically create customized honeypot instances based on specific configurations. The developed honeynet not only addresses the shortcomings of traditional systems but also offers a versatile deception mechanism adaptable to various organizational needs. By providing deeper insights into threat tactics and reducing resource usage through a microservices architecture, this honeynet solution presents a robust and modern approach to tackling current cybersecurity challenges.