Cowrie SSH Honeypot: Architecture, Improvements and Data Visualization

As the competition between threat actors and defenders in the security landscape continues, honeypot deployments become more common as a source of threat intelligence. Yet, documentation for these systems is usually scarce, and their development halts or slows down in time. A better understanding of such systems can lead to deployments of higher deceitfulness, yielding higher quality threat intelligence. This paper aims to improve knowledge about the SSH honeypot Cowrie, presenting both knowledge that aids in understanding its architecture and improvements added to its source code to better suit our deployment or fix encountered issues.