Maayavapi - AI-Powered Honeypot Threat Intelligence Platform

An intelligent honeypot monitoring and analysis system that captures, classifies, and visualizes adversarial attack behavior in real-time. This platform combines traditional honeypot technology with behavioral analysis and machine learning techniques to provide actionable threat intelligence.

Project Overview

Maayavapi is a comprehensive security research platform designed to monitor and analyze attacker behavior in honeypot environments. The system automatically captures attack sessions, enriches IP reputation data, classifies attack patterns using AI-based analysis, and presents findings through an interactive threat intelligence dashboard.

Key Capabilities

• Real-time Attack Monitoring: Continuous capture and analysis of attacker sessions
• Behavioral Classification: AI-powered attack pattern recognition and categorization
• Threat Intelligence Enrichment: Automatic IP reputation analysis and geolocation
• Advanced Alert Engine: Rule-based security alert generation for critical threats
• Interactive Analytics Dashboard: Real-time visualization of attack trends and patterns
• Geographic Attack Mapping: Visual representation of global threat distribution
• Command Analysis: Frequency analysis of attacker commands and techniques

Architecture

Internet Attackers
       ↓
SSH Honeypot Sensor (Cowrie)
       ↓
Log Ingestion Pipeline
       ↓
┌──────────────────────┬───────────────────────┐
│                      │                       │
Threat Intelligence    Attack Classification   Alert Engine
Engine                 Engine                  (Pattern Detection)
│                      │                       │
└──────────────────────┴───────────────────────┘
       ↓
Security Analytics Dashboard
       ↓
Threat Intelligence Reports

System Components

1. Data Ingestion Layer

• Purpose: Collect and normalize honeypot session data
• Implementation: TypeScript data processor with Supabase integration
• File: src/ingestion/dataProcessor.ts
• Features:
  • Session deduplication
  • Timestamp normalization
  • Command extraction and parsing
  • Real-time data streaming

2. Threat Intelligence Engine

• Purpose: Enrich attacker IP addresses with reputation data
• Implementation: IP analysis and geolocation system
• File: src/threatIntel/ipEnrichment.ts
• Capabilities:
  • IP geolocation mapping
  • Abuse score calculation
  • Tor/VPN/Proxy detection
  • ISP identification
  • Risk level assessment

3. Attack Classification Engine

• Purpose: Behavioral analysis and attack categorization
• Implementation: Pattern matching with confidence scoring
• File: src/analysis/attackClassifier.ts
• Attack Categories:
  • Botnet Infection
  • Cryptocurrency Mining
  • Reconnaissance & Scanning
  • Privilege Escalation
  • Reverse Shell Establishment
  • Data Exfiltration
  • Defense Evasion
  • Network Scanning
  • System Destruction
  • Exploitation Frameworks
  • Persistence Mechanisms

4. Alert Engine

• Purpose: Detect critical attack patterns and generate alerts
• Implementation: Rule-based detection with contextual analysis
• File: src/alerts/alertEngine.ts
• Alert Rules:
  • High-risk IP detection
  • Crypto miner deployment
  • Botnet infection attempts
  • Privilege escalation attempts
  • Reverse shell detection
  • Defense evasion techniques
  • Multi-vector attack detection
  • Automated tool identification

5. Analytics Dashboard

• Purpose: Visual threat intelligence interface
• Implementation: React-based real-time dashboard
• Files: src/components/*
• Visualizations:
  • Attack activity timeline
  • Geographic distribution map
  • Attack type breakdown
  • Command frequency analysis
  • Security alert panel
  • Session statistics

Database Schema

Tables

attack_sessions

Stores individual attacker session metadata

• Session identifiers and timing
• Source IP and port information
• Geographic location data
• Session duration and command count

attack_commands

Records all commands executed during sessions

• Raw command strings
• Execution timestamps
• Attack type classification
• Severity ratings

ip_reputation

Threat intelligence for observed IPs

• Abuse scores and report counts
• Network type detection (Tor/VPN/Proxy)
• ISP and geolocation data
• Last reputation check timestamp

attack_alerts

Security alerts triggered by detection engine

• Alert classification and severity
• Detailed descriptions
• Indicator arrays
• Acknowledgment status

attack_statistics

Daily aggregated attack metrics

• Total attack counts
• Unique attacker IPs
• Attack type distribution
• Top attacking countries

Installation & Setup

Prerequisites

• Node.js 18+ and npm
• Supabase account
• Git

Step 1: Clone Repository

git clone https://github.com/UNKN0WN006/maaya-jaal.git
cd maayavapi

Step 2: Install Dependencies

npm install

Step 3: Configure Supabase

1. Create a new Supabase project at https://supabase.com
2. Copy your project URL and anon key
3. Create .env file:

cp .env.example .env

4. Edit .env and add your Supabase credentials:

VITE_SUPABASE_URL=your_project_url
VITE_SUPABASE_ANON_KEY=your_anon_key

Step 4: Database Migration

The database schema will be automatically created when you first access the application. The migration includes:

• All table schemas
• Row Level Security policies
• Performance indexes
• Foreign key relationships

Step 5: Start Development Server

npm run dev

Step 6: Generate Sample Data

On first launch, click "Generate Sample Data" button to populate the dashboard with realistic attack data for testing and demonstration purposes.

Usage

Dashboard Overview

The main dashboard provides a comprehensive view of honeypot activity:

1. Statistics Cards: High-level metrics (total attacks, unique IPs, active alerts)
2. Timeline Chart: Attack activity over time with trend analysis
3. Security Alerts Panel: Real-time critical threat notifications
4. Geographic Map: Visual representation of attack origin distribution
5. Attack Categories: Breakdown of attack types and techniques
6. Command Analysis: Most frequently executed attacker commands
7. Recent Sessions: Detailed view of recent attacker sessions

Understanding Attack Classifications

The system classifies attacks into several categories:

• Botnet Infection (Critical): Automated malware deployment scripts
• Crypto Mining (High): Cryptocurrency miner installation attempts
• Reconnaissance (Medium): System information gathering
• Privilege Escalation (High): Attempts to gain root/admin access
• Reverse Shell (Critical): Remote command execution establishment
• Data Exfiltration (High): Accessing sensitive files and credentials

Alert Severity Levels

• Critical: Immediate attention required (reverse shells, botnets, defense evasion)
• High: Serious threats (privilege escalation, data exfiltration)
• Medium: Concerning activity (extended sessions, Tor connections)
• Low: Minor or benign activity (basic reconnaissance)

Research Applications

This platform serves multiple security research purposes:

1. Adversarial Behavior Analysis: Study attacker tactics, techniques, and procedures (TTPs)
2. Malware Campaign Tracking: Identify and monitor botnet deployment campaigns
3. Geographic Threat Mapping: Analyze global distribution of attack sources
4. Automated Tool Detection: Distinguish between manual and automated attacks
5. Attack Pattern Evolution: Track changes in attacker behavior over time

Technical Implementation Details

Attack Classification Algorithm

The classification engine uses a multi-stage approach:

1. Pattern Matching: Regex-based command analysis against known attack signatures
2. Confidence Scoring: Weighted scoring based on command characteristics
3. Context Analysis: Session-level behavior pattern detection
4. Indicator Extraction: Automatic identification of IOCs (IPs, URLs, file hashes)

Threat Intelligence Enrichment

IP reputation analysis includes:

• Known malicious IP range detection
• Geographic risk scoring
• Network infrastructure type identification
• Historical abuse report integration
• Multi-source correlation

Performance Optimizations

• Database indexes on frequently queried columns
• Client-side data caching
• Efficient React re-rendering with hooks
• Lazy loading for large datasets
• Real-time subscription optimization

Deployment & Sharing

For End Users

Each user/organization should have their own isolated Supabase instance:

1. Create Individual Projects: Users create their own free Supabase project at supabase.com
2. Get Credentials: Each gets unique Project URL and Anon Key
3. Run Migration: Execute the database schema SQL in their Supabase project
4. Deploy App: Clone this repository and configure with their credentials
5. Generate Demo Data: Use the "Generate Sample Data" button to test the system

Production Deployment

For real-world threat intelligence:

1. Connect Real Honeypot: Integrate with SSH honeypot sensors (e.g., Cowrie)
2. Automated Data Ingestion: Configure data pipeline to feed real attack sessions
3. Scale Database: Use Supabase's paid tiers for high-volume honeypot networks
4. Setup Alerts: Configure email/webhook notifications for critical threats
5. Monitor Performance: Use Supabase analytics to track system health

Important: Sample Data Generation ⚠️

MUST WAIT AT LEAST 5 MINUTES after clicking "Generate Sample Data" button:

• The system processes 20+ attack sessions sequentially
• Each session involves multiple database operations (commands, alerts, statistics)
• Premature page refresh interrupts the process
• Wait for confirmation message: "Data generated successfully!"
• Progress bar shows real-time completion status
• After completion, page auto-refreshes to display data

Do NOT:

• Refresh or navigate away during generation
• Close the browser tab
• Click the button multiple times
• Expect instant results

Example Timeline:

Click "Generate Sample Data"
↓ (Wait 1-2 minutes for processing)
Progress bar reaches 100%
↓ (Wait 10-30 seconds for final inserts)
Success message appears
↓ (Automatic page refresh)
Dashboard displays attack data

Security Considerations

Row Level Security (RLS)

All database tables implement RLS policies:

• Public read access for dashboard data
• Authenticated write access for data ingestion
• Proper ownership validation

Data Privacy

• No personally identifiable information (PII) is collected
• Only attacker IP addresses and command data are stored
• All data is considered threat intelligence, not user data

Development Roadmap

Completed Features ✓

• Core honeypot data ingestion pipeline
• AI-based attack classification engine
• Real-time threat intelligence dashboard
• Geographic attack distribution mapping
• Security alert generation system
• IP reputation enrichment

Future Enhancements

• Machine learning model for advanced pattern detection
• Integration with external threat intelligence feeds (AbuseIPDB, VirusTotal)
• MITRE ATT&CK framework mapping
• Automated threat report generation
• Multi-honeypot support
• Email/Slack alert notifications
• Historical trend analysis and forecasting

Technology Stack

Frontend:

• React 18 with TypeScript
• Tailwind CSS for styling
• Lucide React for icons
• Custom data visualization components

Backend & Database:

• Supabase (PostgreSQL)
• Row Level Security (RLS)
• Real-time subscriptions
• RESTful API

Analysis Engines:

• TypeScript-based classification
• Pattern matching algorithms
• Rule-based alert detection
• Statistical analysis

Contributing

This is a research project. Contributions should focus on:

• New attack pattern signatures
• Classification algorithm improvements
• Visualization enhancements
• Performance optimizations
• Documentation updates

Research Citations

If you use this platform for security research, please cite:

Maayavapi: AI-Powered Honeypot Threat Intelligence Platform
Adversarial Command Behavior Modeling and Attack Pattern Classification

Disclaimer

This platform is designed for security research and educational purposes only. The honeypot data collected represents real-world attack attempts and should be handled accordingly. Do not deploy honeypots on networks without proper authorization.

License

This project is for educational and research purposes.

Contact & Support

For questions about the research methodology or implementation details, please open an issue in the repository.

---

Project Status: Active Development Version: 1.2.2 Last Updated: 12th March 2026

This platform demonstrates the intersection of cybersecurity threat intelligence, behavioral analysis, and modern web technologies to provide actionable insights into adversarial attack patterns.