Attack Categories Comparison & Benchmark
Random Forest EvaluatedTop Attacker IP Address (Ranked by Attempts)
Real-Time Attack Activity Timeline
Interactive detected event velocity over chronological time with spike detection.
ATTACK TIMING ANALYSIS
Quantitative hourly density and daily calendar volume computed directly from cowrie.json log stream.
Active Telemetry Event Queue
Sequential live Cowrie honeypot events against Target 172.20.10.2:2222 classified by Random Forest.
| EVENT ID | TIMESTAMP | ATTACKER IP | TARGET ENDPOINT | ORIGIN | EVENT TYPE | PAYLOAD / COMMAND | ML PREDICTION | CONFIDENCE | FORENSIC |
|---|
Random Forest Classification Breakdown
Visual distribution of attacks classified across trained categories.
Model Specifications & Architectural Verification
Artifact: ml/random_forest_model.pklRandom Forest Classifier
Library: scikit-learn (Python)n_estimators = 100 Trees
Verified in ml/train_model.pyclass_weight = "balanced"
random_state = 42Educational Rationale: Why Random Forest in FALSEDOOR?
Random Forest is an ensemble learning method that constructs 100 uncorrelated decision trees during training. In FALSEDOOR, honeypot telemetry is composed of structured categorical and textual tokens (e.g., event IDs, source IPs, commands, and credentials). Rather than relying on a single rule or fragile heuristic, Random Forest applies bootstrap aggregation (bagging) and feature subsampling, achieving high classification robustness and sub-5ms inference speeds on resource-constrained platforms like the Raspberry Pi 5.
Raw Honeypot Audit Log (cowrie.json) & Storage Architecture
Verified Path: var/log/cowrie/cowrie.json
Real-Time Pipeline Health Verification
● 5 of 5 Pipeline Services Operational
FALSEDOOR Academy: Cybersecurity & ML Intelligence Hub
Interactive learning modules grounded in real honeypot telemetry and machine learning principles.
SSH Brute Force Attack
Objective: Adversaries deploy automated bots to cycle through password dictionaries against port 2222 to gain unauthorized shell access.
Observed Indicators: Bursts of cowrie.login.failed events testing credentials like root, admin, pi, and 123456.
Defensive Actions: Disable password authentication entirely, mandate cryptographic public-key authentication, and enforce IP-level rate-limiting via Fail2ban.
Command Execution Attack
Objective: Following access, adversaries execute interactive operating system commands (such as uname -a, pwd, id, cat /etc/passwd) to discover environment privileges and map host resources.
Observed Indicators: cowrie.command.input events captured without remote network retrieval strings.
Defensive Actions: Restrict shell binaries, enforce least-privilege execution, chroot honeypot confinement, and monitor process invocation.
Malware Download Attack
Objective: Adversaries attempt to fetch malicious binaries, stage-1 droppers, or botnet agents (e.g. Mirai, cryptominers) into the decoy environment.
Observed Indicators: Command line payloads containing wget, curl, or tftp requesting remote web servers or raw IPs.
Defensive Actions: Enforce strict outbound egress network filtering, block unauthorized remote downloads, and automatically isolate downloaded payloads for sandbox analysis.
Ensemble Decision Trees & Majority Voting
A single decision tree is prone to high variance and overfitting on structured honeypot logs. Random Forest solves this by training an ensemble of 100 independent decision trees (n_estimators=100). Each individual tree evaluates the event's features and votes on the attack class. The forest takes the majority vote, resulting in high predictive stability.
Feature Importance: Random Forest measures the Gini impurity reduction for each feature, automatically prioritizing high-signal tokens (such as eventid and input commands) to achieve sub-5ms classification speeds on Raspberry Pi hardware.
Verified FALSEDOOR Pipeline Architecture
↓
[var/log/cowrie/cowrie.json] -> Structured JSON Event Audit Trail
↓
[ml/feature_extraction.py] -> 8 Extracted Feature Dimensions
↓
[ml/random_forest_model.pkl] -> 100 Decision Trees Inference (<4ms)
↓
[server/main.py (FastAPI)] -> REST Telemetry Endpoints & Secure Gemini Proxy
↓
[FALSEDOOR Dashboard] -> Real-Time Threat Visualization & Live Attack Map
Note: All active components above are verified in the real codebase. Wazuh is excluded from the active pipeline.
Classification Metrics Explained
• Accuracy: Total correct classifications divided by total samples (Σ Diagonal / Total).
• Precision (TP / [TP + FP]): Out of all samples predicted as an attack, what proportion were genuine attacks?
• Recall (TP / [TP + FN]): Out of all true attacks that occurred, what proportion did the model successfully detect?
• F1-Score: The harmonic mean balancing precision and recall: 2 × (P × R) / (P + R).
• Confidence vs Accuracy: Prediction confidence is the percentage of decision trees that voted for a given class on a single sample; it is pattern probability, not mathematical proof of an active compromise.