Attack Categories Comparison & Benchmark
Random Forest EvaluatedTop Attacker IP Address (Ranked by Attempts)
Real-Time Attack Activity Timeline
Interactive detected event velocity over chronological time with spike detection.
ATTACK TIMING ANALYSIS
Quantitative hourly density and daily calendar volume computed directly from cowrie.json log stream.
Active Telemetry Event Queue
Sequential live Cowrie honeypot events against Target 172.20.10.2:2222 classified by Random Forest.
| EVENT ID | TIMESTAMP | ATTACKER IP | TARGET ENDPOINT | ORIGIN | EVENT TYPE | PAYLOAD / COMMAND | ML PREDICTION | CONFIDENCE | FORENSIC |
|---|
Random Forest Classification Breakdown
Visual distribution of attacks classified across trained categories.
Model Specifications & Architectural Verification
Artifact: ml/random_forest_model.pklRandom Forest Classifier
Library: scikit-learn (Python)n_estimators = 100 Trees
Verified in ml/train_model.pyclass_weight = "balanced"
random_state = 42Educational Rationale: Why Random Forest in FALSEDOOR?
Random Forest is an ensemble learning method that constructs 100 uncorrelated decision trees during training. In FALSEDOOR, honeypot telemetry is composed of structured categorical and textual tokens (e.g., event IDs, source IPs, commands, and credentials). Rather than relying on a single rule or fragile heuristic, Random Forest applies bootstrap aggregation (bagging) and feature subsampling, achieving high classification robustness and sub-5ms inference speeds on resource-constrained platforms like the Raspberry Pi 5.
Raw Honeypot Audit Log (cowrie.json) & Storage Architecture
Verified Path: var/log/cowrie/cowrie.json
Real-Time Pipeline Health Verification
● 5 of 5 Pipeline Services Operational
FALSEDOOR Academy: Cybersecurity & ML Intelligence Hub
Interactive learning modules grounded in real honeypot telemetry and machine learning principles.
SSH Brute Force Attack
Objective: Adversaries deploy automated bots to cycle through password dictionaries against port 2222 to gain unauthorized shell access.
Observed Indicators: Bursts of cowrie.login.failed events testing credentials like root, admin, pi, and 123456.
Defensive Actions: Disable password authentication entirely, mandate cryptographic public-key authentication, and enforce IP-level rate-limiting via Fail2ban.
Command Execution Attack
Objective: Following access, adversaries execute interactive operating system commands (such as uname -a, pwd, id, cat /etc/passwd) to discover environment privileges and map host resources.
Observed Indicators: cowrie.command.input events captured without remote network retrieval strings.
Defensive Actions: Restrict shell binaries, enforce least-privilege execution, chroot honeypot confinement, and monitor process invocation.
Malware Download Attack
Objective: Adversaries attempt to fetch malicious binaries, stage-1 droppers, or botnet agents (e.g. Mirai, cryptominers) into the decoy environment.
Observed Indicators: Command line payloads containing wget, curl, or tftp requesting remote web servers or raw IPs.
Defensive Actions: Enforce strict outbound egress network filtering, block unauthorized remote downloads, and automatically isolate downloaded payloads for sandbox analysis.
Ensemble Decision Trees & Majority Voting
A single decision tree is prone to high variance and overfitting on structured honeypot logs. Random Forest solves this by training an ensemble of 100 independent decision trees (n_estimators=100). Each individual tree evaluates the event's features and votes on the attack class. The forest takes the majority vote, resulting in high predictive stability.
Feature Importance: Random Forest measures the Gini impurity reduction for each feature, automatically prioritizing high-signal tokens (such as eventid and input commands) to achieve sub-5ms classification speeds on Raspberry Pi hardware.
How FALSEDOOR Really Works: 12-Stage Real-Time Honeypot & ML Pipeline
FALSEDOOR is an end-to-end SSH honeypot threat intelligence and machine learning classification platform running on a Raspberry Pi 5 / Ubuntu host (172.20.10.2). Every stage below corresponds directly to active modules in the codebase—from raw TCP packet interception on port 2222 to 1-second real-time browser rendering.
172.20.10.2:2222.var/log/cowrie/cowrie.json.ml/labeling.py → label_event())
Events like
cowrie.session.connect, cowrie.client.kex, and cowrie.session.closed are tagged as SSH Session Activity and bypass ML inference (skipping directly to Stage 7) so non-attack handshakes never distort Random Forest accuracy.
Events matching
cowrie.login.failed (Brute Force), cowrie.command.input (Command Execution / Malware Download), or cowrie.session.file_download proceed into Stages 4 → 5 → 6.
ml/features.py)eventid) + 12 lexical/behavioral features (lengths, tokens, chain ops, download flags, Shannon entropy).<2ms)ml/random_forest_model.pkl to output predicted attack class & tree-vote confidence %.server/main.py detects file changes via (mtime_ns, size), assigns forensic EVT-XXXXXX IDs, caches predictions, and appends to data/enriched_telemetry.csv.api.falsedoor.dev to server/static/app.js, updating all charts, timelines, feeds, and matrices every 1000ms.How Cowrie & ml/labeling.py Separate Traffic
When an attacker connects to port 2222, Cowrie logs every low-level SSH negotiation alongside actual intrusion payloads in var/log/cowrie/cowrie.json.
To prevent harmless TCP/SSH handshakes from skewing machine learning metrics, classify_raw() in server/main.py and label_event() in ml/labeling.py inspect each event first:
• SSH Session Activity: Handshakes (cowrie.session.connect, cowrie.client.version, cowrie.session.closed) bypass the classifier.
• Brute Force: Triggered by cowrie.login.failed credential attempts.
• Malware Download Attempt: Triggered by cowrie.session.file_download or shell commands invoking wget, curl, tftp, scp, ftp, or http(s):// URLs.
• Command Execution: Triggered by interactive shell commands in cowrie.command.input without external download tools.
How the 13 Features & 100 Trees Classify Attacks
Raw log strings cannot be fed directly into decision trees. extract_features() in ml/features.py converts every attack JSON object into 13 numerical & categorical features:
• Authentication Signals: eventid (One-Hot Encoded), failed_login, username_len, password_len.
• Command Structure Signals: cmd_len, cmd_tokens, cmd_chain_ops (;, &&, ||), cmd_pipe_redirect (|, >, <), and Shannon character entropy (cmd_entropy).
• Behavioral Intent Flags: has_download_tool, has_chmod, has_shell_exec, and has_recon.
The Scikit-Learn RandomForestClassifier passes this 13-feature vector through 100 decision trees. The class receiving the highest share of tree votes is selected as the prediction, and the vote percentage becomes the Model Confidence.
How Real-Time Validation & Streaming Work
Every 1 second, the dashboard queries server/main.py (port 8000). Whenever cowrie.json grows, FastAPI re-evaluates the telemetry stream:
• 3×3 Multiclass Confusion Matrix: Each attack event increments cell C[actual_class][predicted_class], where rows are the deterministic ground-truth class and columns are the Random Forest prediction.
• Live One-vs-Rest (OvR) Formulas: From the 3×3 matrix, FALSEDOOR dynamically computes TP, FP, FN, TN, Precision, Recall, Specificity, F1-Score, Overall Accuracy, Macro F1, and Weighted F1.
• Offline Resilience: Every live poll is cached in localStorage and backed by snapshot.json so the dashboard remains inspectable even when the Raspberry Pi honeypot is on standby.
3×3 Multiclass Confusion Matrix & One-vs-Rest (OvR) Formulas
For a 3-class confusion matrix C of size 3 × 3 where row i is the Actual Class and column j is the Predicted Class:
• True Positives (TPi = Ci,i): Diagonal cell where the Random Forest prediction matches the actual attack class.
• False Negatives (FNi = Σj≠i Ci,j): Off-diagonal cells in row i (actual attacks of class i misclassified as another class).
• False Positives (FPi = Σj≠i Cj,i): Off-diagonal cells in column i (other classes falsely predicted as class i).
• True Negatives (TNi = N − (TPi + FPi + FNi)): All remaining events correctly identified as not belonging to class i.
• Overall Accuracy: (Σ TPᵢ) / N — Total diagonal correct predictions divided by total evaluated attacks N.
• Precision: TPᵢ / (TPᵢ + FPᵢ) — Exactness of predictions for class i.
• Recall (Sensitivity): TPᵢ / (TPᵢ + FNᵢ) — Completeness of detection for actual class i events.
• Specificity: TNᵢ / (TNᵢ + FPᵢ) — True negative rate for class i.
• F1-Score: 2 × (Precisionᵢ × Recallᵢ) / (Precisionᵢ + Recallᵢ) — Harmonic mean balancing Precision and Recall.
• Macro vs Weighted Averages: Macro metrics weight all 3 classes equally (1/3)ΣMᵢ, while Weighted F1 weights each class by its actual support Σ(Supportᵢ × F1ᵢ) / N.