🛡️ Real-Time Honeypot Monitoring System

📌 Project Overview

The Real-Time Honeypot Monitoring System is a cybersecurity project designed to simulate attacker activity, capture malicious actions, and visualize security events through a centralized monitoring dashboard.

The project uses a Cowrie SSH Honeypot to mimic a vulnerable Linux server, allowing security administrators to observe attacker behavior without exposing actual production systems.

All captured events are collected, stored, and visualized using modern observability tools, providing real-time insights into suspicious activities.

---

🎯 Objectives

• Detect and monitor unauthorized access attempts.
• Capture attacker commands and login attempts.
• Analyze attacker behavior in a controlled environment.
• Visualize security events through a dashboard.
• Demonstrate practical cybersecurity monitoring techniques.

---

🏗️ Architecture

Attacker VM (Ubuntu)
192.168.0.2
        │
        ▼
Cowrie SSH Honeypot
192.168.0.4:2222
        │
        ▼
Grafana Alloy
        │
        ▼
Loki Log Storage
        │
        ▼
Grafana Dashboard

---

🖥️ Infrastructure

Virtual Machines

VM	IP Address	Purpose
Attacker VM	192.168.0.2	Simulate attacker activity
Real Server VM	192.168.0.3	Production-like web server
Honeypot VM	192.168.0.4	Cowrie Honeypot + Monitoring Stack

---

🔧 Technologies Used

• Ubuntu Server
• Cowrie Honeypot
• Grafana Alloy
• Loki
• Grafana
• Nginx
• SSH

---

🚀 Features

SSH Honeypot

• Simulated SSH server
• Captures login attempts
• Records attacker commands
• Logs attacker sessions

Real-Time Monitoring

• Centralized log collection
• Security event visualization
• Login attempt tracking
• Attack timeline analysis

Decoy Web Server

• Professional banking-style website
• Hosted on port 8080
• Access logging enabled
• Demonstrates web-based deception techniques

---

📊 Dashboard Capabilities

The Grafana dashboard provides:

• Real-time security event monitoring
• Login attempt statistics
• Attack activity timeline
• Live attack logs
• Security event visualization

---

🔍 Demonstration Workflow

1. Attacker connects to the honeypot using SSH.
2. Cowrie records all actions.
3. Alloy collects generated logs.
4. Loki stores security events.
5. Grafana visualizes attacker activity in real time.

---

🛡️ Security Learning Outcomes

This project demonstrates:

• Honeypot deployment
• Threat monitoring
• Log aggregation
• Security visualization
• Attack analysis
• Defensive cybersecurity practices

---

📸 Screenshots

Add screenshots here:

• Infrastucture

• Real Server Web Page

• Fake SSH Server

• Grafana Dashboard

---

👩‍💻 Author

Chand Parveen

B.Tech Computer Science Engineering

Cybersecurity & DevOps Enthusiast

---

📄 License

This project is developed for educational and learning purposes.