HoneyGuard

Overview

HoneyGuard is a honeypot + monitoring platform built to attract and analyze real-world attack traffic. It serves realistic “deceptive” surfaces (CMS logins, admin panels, fake APIs, upload endpoints, CVE simulations) and captures full request metadata for real-time threat detection and historical analysis.

The stack is split into a Flask backend (detection + logging + admin APIs) and a React frontend (honeypot UI + protected dashboard).

What it demonstrates

• Building deceptive services that look real enough to engage scanners and attackers
• A pragmatic detection pipeline:
  • pattern matching + behavior heuristics
  • fingerprints + threat level classification
  • optional IP reputation enrichment (AbuseIPDB)
• Monitoring UX: real-time dashboard, stats, filtering, uploads explorer
• Production hardening patterns:
  • Redis-backed rate limiting (dual policy: permissive honeypot / strict admin)
  • JWT auth for admin APIs
  • containerization + resource limits + non-root runtime

Key features

• Deceptive endpoints (CMS/admin/API/upload/CVE-style surfaces)
• Attack logging with metadata (IP, UA, payload, endpoint, timing)
• Fingerprinting + threat levels (low/medium/high/critical)
• Optional:
  • AbuseIPDB reputation scoring
  • Telegram alerts for critical events
• Redis Cloud integration for:
  • rate limit storage
  • telemetry / caching / flags
• Docker-first deployment (Gunicorn + gevent)

Architecture notes

• Backend (Flask)

  • Exposes honeypot endpoints + protected admin APIs
  • Stores logs in SQLite and uses Redis for rate limiting + transient state
  • Optional enrichment + notifications via external services

• Frontend (React)

  • Public-facing honeypot pages to attract traffic
  • Protected real dashboard for monitoring and analysis
  • Env-driven API base URL (do not expose secrets client-side)

Quickstart

git clone https://github.com/casaisdev/HoneyGuard.git

See docs:

• Backend setup (Redis, env, Docker hardening):
  • https://github.com/casaisdev/HoneyGuard/blob/main/backend/README.md
• Frontend setup (env + routes + build):
  • https://github.com/casaisdev/HoneyGuard/blob/main/frontend/README.md

Notes

• Keep honeypot routes permissive (to observe attacker behavior), but keep auth/dashboard routes strict and access-controlled.
• Prefer deploying behind a reverse proxy with TLS and IP restrictions for admin access.
• Never commit secrets (.env, Redis creds, JWT secrets, Telegram tokens).

Next steps

If I were to evolve HoneyGuard further:

• Add SIEM-friendly exports (JSONL/Elastic/Splunk formats)
• Add a “rules UI” for fingerprints (severity, routing, alert thresholds)
• Add session correlation (group attacks by IP/UA/time window)
• Add long-term storage and rollups (Postgres + retention policies)