ThreatHive: Honeypot and AI Powered Intrusion Detection System

As cyber threats become more sophisticated, traditional security measures struggle to detect and mitigate advanced attacks. This paper introduces ThreatHive, an AI- powered Intrusion Detection System (IDS) integrated with a honeypot to enhance attacker behavior analysis and threat intelligence. The system employs machine learning models, including LightGBM, trained on the CICIDS-2017 dataset to detect various cyberattacks in real time. Upon identifying a threat, the system automatically redirects attackers to the Honeypot via a PFSense firewall, where their interactions are logged for further analysis. Threat intelligence is visualized using Elastic Stack (Elasticsearch, Kibana), providing real-time insights into attack patterns. Additionally, the captured data feeds back into the AI model, improving future detection accuracy. Experimental evaluations demonstrate the system’s effectiveness in mitigating both brute force and complex cyberattacks, making it a robust and adaptive cybersecurity solution.