1 line
17 KiB
JSON
1 line
17 KiB
JSON
{"repo": "afeldman/honeytrap", "files": {"README.md": {"512d222e9257ba164a17e31dbbe61ade35e51a3f": {"t": 1785596404.4237037, "n": 13083, "h": "744826b5cc8e4860", "c": "<div align=\"center\">\n <img src=\"docs/logo.png\" alt=\"HoneyTrap Logo\" width=\"200\"/>\n \n # HoneyTrap\n\n🍯 **AI-Powered Zero Trust Network Access with Intelligent Deception**\n\n[](https://github.com/afeldman/honeytrap/actions)\n[](https://github.com/afeldman/honeytrap/releases)\n[](LICENSE)\n[](https://www.rust-lang.org)\n\n## 🎯 Overview\n\nHoneyTrap is a Rust-based security system that uses **AI-powered anomaly detection** to identify potential attackers and intelligently redirect them into **honeypots** for analysis, while allowing legitimate traffic to pass through.\n\n## ✨ Features\n\n- **🤖 AI Anomaly Detection**: RandomForest ML model + heuristic analysis\n- **🧠 LLM Integration**: DeepSeek & OpenAI for intelligent behavior analysis\n- **🎓 Reinforcement Learning**: Q-Learning for adaptive defense strategies\n- **🌲 RandomForest Model**: Supervised learning for accurate anomaly detection\n- **🍯 Advanced Honeypot Interactions**: Realistic SSH, HTTP, MySQL protocol emulation\n- **💻 Fake Shell Environment**: Command parsing, filesystem simulation, credential capture\n- **🎭 Intelligent Response Strategies**: Adaptive engagement based on attacker behavior\n- **📜 Dual Scripting Engines**: Python & Rhai for flexible customization\n- **🔐 Secure QUIC Transport**: Modern, encrypted networking with Quinn\n- **📊 Real-time Monitoring**: Session tracking and statistics\n- **🎯 Zero Trust Architecture**: Every connection is analyzed\n- **🐳 Container Ready**: Docker and Kubernetes support\n- **📦 Easy Deployment**: systemd, Docker Compose, K8s\n\n## 🚀 Quick Start\n\n### Using Make (Recommended)\n\n```bash\n# Setup development environment\nmake deps\n\n# Build\nmake build\n\n# Run server\nmake run-server\n\n# Run with Docker\nmake docker\n\n# Show all commands\nmake help\n```\n\n### Using Cargo\n\n```bash\n# Build\ncargo build --release\n\n# Run CLI\ncargo run --bin honeytrap\n\n# Run server\ncargo run --bin honeytrap-server\n\n# With config\nHONEYTRAP_CONFIG=config/honeytrap.toml cargo run --bin honeytrap-server\n```\n\n### Docker\n\n```bash\n# Using docker-compose (Production)\ndocker-compose -f docker/docker-compose.yml up -d\n\n# Using docker-compose (Development)\ndocker-compose -f docker/docker-compose.dev.yml up\n\n# Using Makefile\nmake docker # Start production stack\nmake docker-dev # Start development environment\nmake docker-logs # View logs\nmake docker-stop # Stop services\n\n# Build specific images\nmake docker-build-server # Production server\nmake docker-build-cli # CLI tool\nmake docker-build-dev # Development environment\n\n# View all images\nls -la docker/\n```\n\nSee `docker/README.md` for comprehensive Docker documentation.\n\n### Kubernetes\n\n```bash\nkubectl apply -f crates/honeytrap-server/k8s-deployment.yaml\n```\n\n## 📁 Project Structure\n\n```text\nhoneytrap/\n├── crates/\n│ ├── honeytrap-core/ # Core routing and session management\n│ ├── honeytrap-ai/ # AI: RandomForest, RL Agent, LLM integration\n│ ├── honeytrap-deception/ # Advanced honeypot interactions\n│ ├── honeytrap-protocol/ # QUIC transport layer\n│ ├── honeytrap-scripting/ # Python & Rhai scripting engines\n│ ├── honeytrap-metrics/ # Prometheus metrics & monitoring\n│ ├── honeytrap-cli/ # Command-line interface\n│ └── honeytrap-server/ # Production server binary\n├── grafana/ # Grafana dashboard templates\n├── web-ui/ # React web dashboard\n├── mobile-app/ # React Native mobile app\n├── docker/ # Docker configurations\n│ ├── Dockerfile.server # Production server image\n│ ├── Dockerfile.cli # CLI tool image\n│ ├── Dockerfile.dev # Development environment\n│ ├── docker-compose.yml # Production stack\n│ └── docker-compose.dev.yml # Development stack\n├── scripts/ # Development and deployment scripts\n├── .github/workflows/ # CI/CD pipelines\n├── Makefile # Build automation\n└── DEVELOPMENT.md # Development guide\n```\n\n## 🔧 Configuration\n\n### Basic Setup\n\nEdit `config/honeytrap.toml`:\n\n```toml\n[network]\nbind_addr = \"0.0.0.0:8443\"\n\n[ai]\nwindow_size = 100\nanomaly_threshold = 0.7\n\n[llm]\nenabled = true\nprovider = \"deepseek\" # or \"openai\"\nmodel = \"deepseek-chat\" # or \"gpt-4o-mini\"\n\n[[honeypots]]\nport = 22\nservice_type = \"ssh\"\ninteraction_level = \"medium\"\n```\n\n### LLM Setup\n\n1. **DeepSeek (Recommended - Cheaper)**\n\n ```bash\n # Get API key from https://platform.deepseek.com\n export HONEYTRAP_LLM_API_KEY=\"sk-...\"\n ```\n\n2. **OpenAI**\n\n ```bash\n # Get API key from https://platform.openai.com\n export HONEYTRAP_LLM_API_KEY=\"sk-...\"\n ```\n\n3. Update config:\n\n ```toml\n [llm]\n enabled = true\n provider = \"deepseek\" # or \"openai\"\n ```\n\n## 🤖 AI & Machine Learning\n\nHoneyTrap integrates multiple AI/ML techniques:\n\n### 1. RandomForest Classifier\n\nSupervised learning for anomaly detection:\n\n### Training the Model\n\n```bash\n# Run training example\ncargo run --example train_model\n\n# Output:\n# 🌲 RandomForest Training Example\n# 📊 Generating training dataset...\n# Generated 210 samples\n# 🧠 Training RandomForest model...\n# ✅ Training accuracy: 1.0000\n```\n\n### Using the Model\n\n```rust\nuse honeytrap_ai::AnomalyDetector;\n\nlet mut detector = AnomalyDetector::new(100);\n\n// Train with your data\nlet training_data = vec![\n (vec![443.0, 8443.0, 10.0, ...], false), // normal\n (vec![12345.0, 8443.0, 0.5, ...], true), // anomaly\n];\ndetector.train(training_data).await?;\n\n// Analyze traffic\nlet (is_anomaly, score) = detector.analyze(&features).await?;\n```\n\n### Features\n\nThe model uses 10 network features:\n\n- Source port, Destination port\n- Duration, Inter-packet time\n- Bytes sent/received\n- Packets sent/received\n- Failed logins, Command frequency\n\n### Model Persistence\n\n```bash\n# Save model\ndetector.save_model(\"model.json\").await?;\n\n# Load model\ndetector.load_model(\"model.json\").await?;\n```\n\n### 2. Reinforcement Learning Agent\n\nQ-Learning for adaptive honeypot strategies:\n\n```bash\n# Train RL agent\ncargo run --package honeytrap-ai --example rl_training\n\n# Output:\n# 🤖 Reinforcement Learning Training Example\n# 🎯 Training for 1000 episodes...\n# ✅ Training completed!\n# 📈 Final Stats:\n# Episodes trained: 1000\n# States explored: 1000\n# Avg Q-value: 1.71\n```\n\n**Actions**: Ignore, MinimalResponse, StandardEngagement, DeepEngagement, Block\n\n**Strategy**: Epsilon-greedy policy with adaptive engagement based on attacker sophistication\n\n### 3. LLM Integration\n\nDeepSeek/OpenAI for behavior analysis and intelligent decision-making\n\n## 🍯 Advanced Honeypot Interactions\n\nRealistic protocol emulation with intelligent engagement:\n\n### SSH Honeypot\n\n```bash\n# Run SSH interaction demo\ncargo run --package honeytrap-deception --example advanced_interactions\n```\n\n**Features:**\n\n- Fake shell with command parsing\n- Realistic Linux filesystem simulation\n- Credential capture and logging\n- Malicious command detection (wget, curl, rm -rf, etc.)\n- Command history tracking\n\n### HTTP Honeypot\n\n**Features:**\n\n- Fake web application (login, admin panel)\n- Attack detection (SQLi, XSS, directory traversal)\n- Credential capture from login forms\n- Configurable response strategies\n\n### MySQL Honeypot\n\n**Features:**\n\n- MySQL protocol handshake\n- Query parsing and response generation\n- SQL injection detection (UNION, SLEEP, etc.)\n- Database/table enumeration simulation\n\n### Response Strategies\n\n- **Minimal**: Quick responses, low engagement\n- **Standard**: Realistic responses\n- **Deep**: Maximum engagement, waste attacker time\n- **Adaptive**: Adjust based on attacker behavior\n\n## 📜 Scripting\n\nExtend HoneyTrap with Python or Rhai scripts:\n\n```bash\n# Rhai scripting\ncargo run --package honeytrap-scripting --example rhai_scripting\n\n# Python scripting\ncargo run --package honeytrap-scripting --example python_scripting\n```\n\n**Use Cases:**\n\n- Custom anomaly detection logic\n- Dynamic honeypot responses\n- Attack pattern analysis\n- Integration with external systems\n\n## 📊 Metrics & Monitoring\n\nPrometheus metrics for comprehensive monitoring:\n\n### Quick Start\n\n```bash\n# Run metrics demo\ncargo run --package honeytrap-metrics --example metrics_demo\n\n# Access metrics\ncurl http://localhost:9090/metrics\n\n# Health check\ncurl http://localhost:9090/health\n```\n\n### Available Metrics\n\n**Connection Metrics:**\n\n- `honeytrap_connections_total` - Total connections received\n- `honeytrap_connections_active` - Currently active connections\n- `honeytrap_connections_by_result` - Connections by classification (normal/anomaly/blocked)\n- `honeytrap_connection_duration_seconds` - Connection duration histogram\n- `honeytrap_bytes_total` - Bytes transferred (sent/received)\n\n**Honeypot Metrics:**\n\n- `honeytrap_honeypot_sessions_total` - Total sessions by type (ssh/http/mysql)\n- `honeytrap_honeypot_sessions_active` - Active sessions by type\n- `honeytrap_credentials_captured_total` - Captured credentials count\n- `honeytrap_commands_executed_total` - Commands executed in honeypots\n- `honeytrap_malicious_commands_total` - Detected malicious commands\n- `honeytrap_honeypot_session_duration_seconds` - Session duration histogram\n\n**ML Metrics:**\n\n- `honeytrap_ml_predictions_total` - ML predictions by model and result\n- `honeytrap_ml_inference_duration_seconds` - Model inference time\n- `honeytrap_anomaly_scores` - Distribution of anomaly scores\n- `honeytrap_rl_actions_total` - RL agent actions taken\n- `honeytrap_rl_q_values` - RL agent Q-values\n\n**System Metrics:**\n\n- `honeytrap_uptime_seconds` - System uptime\n- `honeytrap_memory_bytes` - Memory usage\n- `honeytrap_cpu_usage_percent` - CPU usage\n- `honeytrap_active_tasks` - Active async tasks\n\n### Prometheus Configuration\n\n```yaml\nscrape_configs:\n - job_name: \"honeytrap\"\n static_configs:\n - targets: [\"localhost:9090\"]\n scrape_interval: 15s\n```\n\n### Grafana Dashboard\n\nImport the provided dashboard template from `grafana/honeytrap-dashboard.json`:\n\n```bash\n# Import in Grafana UI\n1. Go to Dashboards → Import\n2. Upload grafana/honeytrap-dashboard.json\n3. Select Prometheus data source\n```\n\n**Dashboard Panels:**\n\n- Connection analysis (rate, distribution)\n- Honeypot activity (sessions by type, credentials captured)\n- ML model performance (anomaly scores, RL actions, inference time)\n- System resource usage (CPU, memory)\n\nSee `grafana/README.md` for detailed documentation.\n\n## 🌐 Web UI\n\nModern React dashboard for desktop monitoring:\n\n### Quick Start\n\n```bash\ncd web-ui\nnpm install\nnpm run dev\n```\n\nOpen http://localhost:3001\n\n### Docker Deployment\n\n```bash\ncd web-ui\n\n# Build and run\ndocker build -t honeytrap-ui:latest .\ndocker run -d -p 80:80 honeytrap-ui:latest\n\n# Or use Docker Compose\ndocker-compose up -d\n```\n\n**Docker Features:**\n\n- Multi-stage build (~25MB image)\n- Nginx with reverse proxy\n- Health checks and auto-restart\n- Production-ready configuration\n\n**Features:**\n\n- Real-time dashboard with live metrics\n- Connection monitoring and classification\n- Honeypot session viewer\n- ML metrics visualization\n- Dark theme, responsive design\n\n**Tech Stack:** React 18, TypeScript, Vite, TailwindCSS, Recharts\n\nSee `web-ui/README.md` and `web-ui/DOCKER.md` for full documentation.\n\n## 📱 Mobile App\n\nReact Native app for iOS and Android monitoring:\n\n### Quick Start\n\n```bash\ncd mobile-app\nnpm install\nnpm start\n\n# Scan QR code with Expo Go app\n```\n\n**Features:**\n\n- Real-time dashboard\n- Pull-to-refresh\n- Connection statistics\n- Session monitoring\n- System metrics\n\n**Platforms:** iOS 13+, Android 5+ (API 21+)\n\nSee `mobile-app/README.md` for build & deployment instructions.\n\n## 📖 Documentation\n\nSee `/Users/anton.feldmann/lynq/honeytrap/overview.md` for comprehensive documentation.\n\n## 🛠️ Development Status\n\n**Phase 1: Core Implementation** ✅\n\n- [x] Project structure\n- [x] Core orchestration\n- [x] Session management\n- [x] Router implementation\n- [x] AI anomaly detection (basic)\n- [x] Honeypot system (basic)\n- [x] QUIC transport (skeleton)\n\n**Phase 2: Advanced Features** ✅\n\n- [x] Full QUIC implementation with Quinn\n- [x] RandomForest ML model\n- [x] Reinforcement Learning (Q-Learning)\n- [x] Advanced honeypot interactions (SSH, HTTP, MySQL)\n- [x] Fake filesystem and command parsing\n- [x] Scripting engines (Python & Rhai)\n- [x] Intelligent response strategies\n- [x] Prometheus metrics & monitoring\n- [x] Grafana dashboards\n- [x] Web UI (React)\n- [x] Mobile App (React Native)\n\n**Phase 3: Production Ready** 🚧\n\n- [ ] REST API for UI integration\n- [ ] WebSocket for real-time updates\n- [ ] Alert manager integration\n- [ ] Enhanced structured logging\n- [ ] Performance optimization and benchmarks\n- [ ] Comprehensive documentation\n- [ ] Load testing and security audit\n\n## 📝 License\n\nMIT License - see [LICENSE](LICENSE) file for details.\n\n## 👥 Author\n\nAnton Feldmann\n"}}, "crates/honeytrap-server/honeytrap.example.toml": {"512d222e9257ba164a17e31dbbe61ade35e51a3f": {"t": 1785745378.6074111, "n": 1638, "h": "220b2b8b14a98197", "c": "# HoneyTrap Server Configuration\n# Version: 0.1.0\n\n[network]\n# Bind address for the server\nbind_addr = \"0.0.0.0:8080\"\n\n# Backend servers to protect\n[[network.backends]]\nname = \"api-server\"\naddress = \"192.168.1.10:3000\"\nweight = 100\n\n[[network.backends]]\nname = \"web-server\"\naddress = \"192.168.1.11:80\"\nweight = 100\n\n[ai]\n# AI anomaly detection settings\nwindow_size = 100\nthreshold = 0.75\nlearning_rate = 0.01\nenable_online_learning = true\n\n[llm]\n# LLM-powered behavior analysis\nenabled = true\nprovider = \"deepseek\" # Options: deepseek, openai\nmodel = \"deepseek-chat\"\napi_key = \"your-api-key-here\" # Set via environment: DEEPSEEK_API_KEY or OPENAI_API_KEY\nmax_tokens = 1000\ntemperature = 0.7\n\n[security]\n# Security policies\nmax_connections = 10000\nrate_limit_per_ip = 100 # requests per minute\nblock_duration = 3600 # seconds (1 hour)\nenable_ip_blocking = true\n\n[logging]\n# Logging configuration\nlevel = \"info\"\nformat = \"json\" # Options: json, text\noutput = \"stdout\" # Options: stdout, file\nfile_path = \"/var/log/honeytrap/server.log\"\n\n# Honeypot configurations\n[[honeypots]]\nservice_type = \"ssh\"\nport = 2222\ninteraction_level = \"medium\" # Options: low, medium, high\nenabled = true\n\n[[honeypots]]\nservice_type = \"http\"\nport = 8081\ninteraction_level = \"high\"\nenabled = true\n\n[[honeypots]]\nservice_type = \"mysql\"\nport = 3307\ninteraction_level = \"low\"\nenabled = false\n\n[monitoring]\n# Monitoring and metrics\nenable_metrics = true\nmetrics_port = 9090\nhealth_check_interval = 30 # seconds\n\n[deception]\n# Deception tactics\nenable_fake_services = true\nrandomize_responses = true\nhoneypot_diversity = \"high\" # Options: low, medium, high\n"}, "9c2b4236fa69ae51d2d383bc8a72abdaa1496cf1": {"t": 1785750860.614426, "n": 1638, "h": "220b2b8b14a98197", "c": "# HoneyTrap Server Configuration\n# Version: 0.1.0\n\n[network]\n# Bind address for the server\nbind_addr = \"0.0.0.0:8080\"\n\n# Backend servers to protect\n[[network.backends]]\nname = \"api-server\"\naddress = \"192.168.1.10:3000\"\nweight = 100\n\n[[network.backends]]\nname = \"web-server\"\naddress = \"192.168.1.11:80\"\nweight = 100\n\n[ai]\n# AI anomaly detection settings\nwindow_size = 100\nthreshold = 0.75\nlearning_rate = 0.01\nenable_online_learning = true\n\n[llm]\n# LLM-powered behavior analysis\nenabled = true\nprovider = \"deepseek\" # Options: deepseek, openai\nmodel = \"deepseek-chat\"\napi_key = \"your-api-key-here\" # Set via environment: DEEPSEEK_API_KEY or OPENAI_API_KEY\nmax_tokens = 1000\ntemperature = 0.7\n\n[security]\n# Security policies\nmax_connections = 10000\nrate_limit_per_ip = 100 # requests per minute\nblock_duration = 3600 # seconds (1 hour)\nenable_ip_blocking = true\n\n[logging]\n# Logging configuration\nlevel = \"info\"\nformat = \"json\" # Options: json, text\noutput = \"stdout\" # Options: stdout, file\nfile_path = \"/var/log/honeytrap/server.log\"\n\n# Honeypot configurations\n[[honeypots]]\nservice_type = \"ssh\"\nport = 2222\ninteraction_level = \"medium\" # Options: low, medium, high\nenabled = true\n\n[[honeypots]]\nservice_type = \"http\"\nport = 8081\ninteraction_level = \"high\"\nenabled = true\n\n[[honeypots]]\nservice_type = \"mysql\"\nport = 3307\ninteraction_level = \"low\"\nenabled = false\n\n[monitoring]\n# Monitoring and metrics\nenable_metrics = true\nmetrics_port = 9090\nhealth_check_interval = 30 # seconds\n\n[deception]\n# Deception tactics\nenable_fake_services = true\nrandomize_responses = true\nhoneypot_diversity = \"high\" # Options: low, medium, high\n"}}}} |