skip to content
← cd ~/engagements
Security Project · 2025 · Network IDS

Protocol Honeypot

A network-based intrusion detection system and honeypot built to attract, capture and analyse real reconnaissance and unauthorised access attempts, profiling attacker behaviour into alerts an analyst can act on rather than raw noise.

  • IDS
  • Honeypot
  • Log correlation
  • Linux

objective

Turn unsolicited scanning and access attempts into structured, actionable alerts instead of raw log noise.

environment

  • Network IDS
  • Honeypot
  • Linux
  • Log correlation

approach

  1. 01Designed and deployed a network-based IDS alongside a honeypot to attract and capture unauthorised access attempts.
  2. 02Logged reconnaissance traffic and correlated repeated behaviour into attacker profiles rather than isolated events.

outcome

  • ›Recon and unauthorised access attempts surfaced as alerts an analyst can triage.
  • ›Attacker behaviour profiled by pattern, not by single hits.

how it works

alert lifecycle — from match to written up
00:00rule matches, alert raised00:01triage — real or noise00:02scope — which hosts, how far00:03contain — active response or manual00:04record — what fired, what was tuned

highlights

  • $Captures and logs unauthorised access and recon traffic
  • $Correlates attacker behaviour into actionable alerts
  • $Profiles technique patterns rather than single events

scope

Every technique referenced here was executed inside authorised environments — my own virtualised lab hosts, DVWA, and systems I was engaged to assess. Attack simulation is always paired with the detection or hardening that answers it: that pairing is the whole point of the work, not a disclaimer on it.

write-up →ask me about this