This paper focuses on interaction of Honeypots with Machine Learning for threat detection by finding out the patterns, anomalies, and learn from them. In this particular study, Cowrie Honeypot has been deployed on an Ubuntu Server, and its own environment is set up using python. The environment is totally isolated from the original actual server environment, and cowrie mimics the original environment, thereby luring the Hackers/Attackers to fall into the trap. Cowrie generally interacts with the SSH environment, and all the commands, IP addresses, and timestamps are captured in the log file, which is saved in the path defined by the Administrator. Further, the log file is converted to csv file for feeding the collected data to Altair RapidMiner for its Clustering Algorithm. In RapidMiner, the csv file is retrieved, fed to Select Attribute so that the desired attributes are selected and filtered. Cowrie log generally contains a handful of noise, so normalization is needed. However, since normalization is done using z-transformation, it accepts only numerical values. This nominal-to-numerical converter is added in the process for further feeding to the Normalize operator. The normalized data is then fed to the Clustering operator, where the K-Means Clustering Algorithm is deployed in this research. In this study, 3 Clusters are studied. Using clustering analysis revealed distinct patterns in SSH honeypot attack behavior, effectively transforming unprocessed log data into actionable intelligence for strengthening proactive security responses. In summary, integrating honeypot deception strategies with machine learning represents a significant advancement in the field of cybersecurity. This combined approach enhances threat detection and analysis while paving the way for robust, adaptive, and self-evolving security systems capable of countering ever-changing cyber threats.

Honeypots Cowrie Ubuntu Machine Learning SSH