Implementing Honeypots for Detecting Cyber Threats with AWS using the ELK

Abstract

The growing need to use cloud computing to design information systems that are accessible 24/7 opens up a great opportunity for potential attacks by malicious actors. Every day, we see a large number of cyberattacks in all aspects of life. One of the methods of solving the problem of countering hackers is to protect the server using a honeypot. The proliferation of multi-level honeypots characterizes one of the methods of detecting and preventing the actions of criminals by generating a fake server to redirect hacker attacks. In our work, we propose to use honeypots as an element of IT infrastructure intelligence to identify vulnerabilities and study patterns of potential attacks. To achieve this goal, we deployed honeypots in five different regions of the AWS cloud provider. The data obtained was analyzed using ELK Stack (elasticsearch, logstash, kibana). The integration of honeypot and ELK Stack demonstrates an effective solution for detecting potential attacks by providing a detailed visualization of the behavior of attackers.