Enhancing Honeypot Realism: A Framework for Improved Cyber Threat Intelligence Through Dynamic Web Cloning

As cyber security threats continue to evolve in sophistication, honeypots solution remain essential tools for observing attacker behavior and gathering threat intelligence. Traditional honeypot setups, however, often prove inadequate as attackers become increasingly skilled at detecting honeypot for deception capabilty. This paper introduces an advanced honey-pot framework designed to address these limitations by closely emulating realistic web applications. Leveraging a dynamic website cloning method, the framework successfully attracts a broad spectrum of attacks, including credential stuffing, brute-force attempts, and reconnaissance scans. The honeypot was deployed in two stages: an initial baseline setup, followed by an enhanced configuration incorporating web cloning and interaction modules, which led to a threefold increase in captured attacks. These realistic features not only improved attacker engagement but also encouraged adversaries to employ more sophisticated techniques, exploiting perceived vulnera-bilities. The resulting data offers actionable intelligence and deeper insights into attacker tactics, techniques, and procedures (TTPs), which are critical for developing robust cybersecurity defenses. By simulating authentic web interactions, this framework demonstrates the potential of advanced honeypots to proactively inform and strengthen cybersecurity strategies against evolving threats. This research underscores the value of realistic honeypot environments in enhancing threat detection and response capabilities for cyber security organisation teams.