Custom Python-Based SSH Honeypot

Real-Time Dashboard and Attack Analysis

A custom Python-based SSH Honeypot developed to monitor unauthorized SSH login attempts, capture attacker interactions, analyze collected logs, and visualize attack statistics through a Flask-based dashboard.

---

Project Overview

This project is a custom Python-based SSH Honeypot developed as part of my Cybersecurity Internship at Codec Technologies.

The project simulates a realistic SSH server environment to safely monitor unauthorized login attempts. It captures authentication information such as usernames and passwords, records commands executed by attackers, stores activities in log files, analyzes collected data, and presents summarized attack statistics through a Flask-based dashboard.

Instead of relying on existing SSH honeypot frameworks such as Cowrie, this project implements the core functionality using the Paramiko library. Building the project from scratch helped me understand SSH communication, authentication, logging mechanisms, and attack monitoring techniques internally.

---

Problem Statement

SSH services are one of the most common targets for brute-force attacks and unauthorized login attempts.

Monitoring these attacks helps security professionals understand attacker behavior, identify attack patterns, and improve defensive security strategies.

This project simulates an SSH server that safely records attacker activities without exposing a real production system. The collected information is analyzed to identify common attack patterns and visualize the results through a web dashboard.

---

Objectives

• Build a custom SSH Honeypot using Python.
• Simulate a realistic SSH login environment.
• Capture usernames and passwords entered during authentication.
• Record commands executed after successful login.
• Store attack activities in log files.
• Analyze collected logs to identify attack patterns.
• Generate attack reports from collected data.
• Display attack statistics using a Flask dashboard.
• Gain practical cybersecurity knowledge by implementing the project from scratch.

---

Key Features

• Custom SSH server built using Paramiko.
• Interactive fake Linux shell.
• Username and password capture.
• Authentication logging.
• Command logging.
• Honeypot log generation.
• Log analyzer with attack statistics.
• Automatic attack report generation.
• Flask-based monitoring dashboard.
• Responsive Bootstrap interface.
• Custom CSS styling.
• Modular Python project architecture.

---

Technologies Used

Technology	Purpose
Python	Core application development
Paramiko	SSH server implementation
Flask	Dashboard development
Bootstrap 5	Responsive dashboard UI
HTML	Dashboard structure
CSS	Custom dashboard styling
Jinja2	Dynamic template rendering
Python Logging	Attack activity logging

---

Project Structure

HONEYPOT_CYBERSECURITY/
│
├── server.py
├── analyzer.py
├── app.py
├── logger.py
├── config.py
├── environment.py
├── filesystem.py
├── requirements.txt
├── README.md
│
├── logs/
│   └── honeypot.log
│
├── report/
│   └── attack_report.txt
│
├── templates/
│   └── index.html
│
└── static/
    └── css/
        └── style.css

---

System Workflow

1. The SSH Honeypot starts listening for incoming SSH connections.
2. An attacker attempts authentication using a username and password.
3. Authentication details are captured and stored in log files.
4. A fake Linux shell is presented after successful authentication.
5. Commands entered by attackers are recorded.
6. The analyzer processes the collected log data.
7. Attack statistics and reports are generated.
8. The Flask dashboard displays summarized attack information.

---

Requirements

• Python 3.10 or above
• Flask
• Paramiko

---

Installation

Clone the repository

git clone <repository-url>

Navigate into the project directory

cd custom-python-ssh-honeypot

Install dependencies

pip install -r requirements.txt

---

Running the Project

1. Start the SSH Honeypot

python server.py

The SSH Honeypot starts listening for incoming connections.

---

2. Connect to the Honeypot

Open another terminal and connect using:

ssh test@127.0.0.1 -p 2222

Enter any username and password to interact with the simulated SSH environment.

---

3. Generate Attack Report

python analyzer.py

This analyzes collected logs and generates a detailed attack report.

---

4. Launch Dashboard

python app.py

Open the browser and visit:

http://127.0.0.1:5000

The dashboard displays summarized attack statistics collected from the honeypot logs.

---

Project Demo

The project begins by simulating an SSH server that accepts incoming authentication attempts and presents a fake Linux shell to connected users.

Authentication attempts including usernames, passwords, timestamps, and executed commands are recorded in log files.

The collected logs are processed by the analyzer module to generate structured attack reports containing login statistics, commonly used usernames, passwords, and executed commands.

The Flask-based dashboard provides a user-friendly interface for monitoring and analyzing captured attacker activities.

---

Lessons Learned

Developing this project provided practical exposure to defensive cybersecurity concepts and Python network programming.

Through this project, I learned how SSH authentication works, how attackers interact with exposed SSH services, how login attempts can be monitored safely, and how log analysis can be used to understand attacker behavior.

Building each module manually improved my understanding of modular software development, debugging, Flask integration, and designing cybersecurity applications from scratch.

---

Future Enhancements

• Support additional Linux commands.
• Improve realism of the fake Linux shell.
• Display real-time attack statistics without refreshing the dashboard.
• Visualize attacker IP addresses and login trends.
• Export attack reports in PDF and CSV formats.
• Support multiple honeypot services.
• Improve command emulation for realistic attacker interaction.

---

Security Disclaimer

This project is created only for educational and defensive cybersecurity learning purposes.

It should not be deployed on public networks without proper authorization and security controls.

---

About the Author

Divyasritha. R

B.Tech – Artificial Intelligence and Data Science

Cybersecurity Intern at Codec Technologies

This project was developed as part of my cybersecurity internship to gain practical knowledge of SSH security, attacker behavior, log analysis, and defensive cybersecurity techniques.

Rather than using an existing SSH honeypot framework, I implemented the core functionality myself to better understand how SSH honeypots work internally.

---

License

This project was developed for educational purposes as part of a cybersecurity internship.

It is intended for learning, experimentation, and demonstration only.