⚠ AUTHORIZED USE ONLY — Deploy honeypots only on systems you own or have explicit written authorization to monitor. Unauthorized monitoring may violate privacy laws.

Deception-Based Security System

Deploy fake credential files and private keys as honeytokens. Catch attackers the moment they touch your bait — with real-time alerts, process identification, and webhook delivery.

0
Total Alerts
0
Critical Alerts
0
Active Decoys
—
Last Triggered
deception_system.py — deployment console
// Deception-Based Security System — SOC demo
// Press "Deploy Honeypots" to initialize the honeypot grid.
 
$

How Active Defense Works

Honeytokens turn attackers' own techniques against them — the moment they touch the bait, you know.

🍯

Honeytoken Deployment

Realistic-looking fake credentials — AWS keys, GitHub tokens, DB passwords — are placed where attackers expect to find real secrets.

👁

Real-Time File Monitoring

Watchdog observes every filesystem event. Access, modification, deletion, or movement of a decoy file triggers an instant alert.

🔍

Process Identification

psutil captures the PID, process name, username, and full command line of the process that touched the honeytoken.

📡

Webhook Integration

Structured JSON alerts are POSTed to any HTTP endpoint — Slack, PagerDuty, SIEM, or your own incident response platform.

🏗

Honeypath Directories

Decoys are deployed in backup/, scripts/, and private/ subdirectories to maximize the probability that a scanning attacker encounters them.

📊

Severity Classification

Events are classified CRITICAL / HIGH / MEDIUM / LOW. Configure a minimum alert level to reduce noise while catching genuine threats.