Targeted Honeypot Deployment for Analyzing and Mitigating Threats

Cyber threats continue to evolve, posing significant risks to small and mid-sized businesses that often lack the financial resources for advanced cybersecurity. With the rise of sophisticated attack techniques like brute-force attempts, ransomware infections, and credential stuffing, these businesses become prime targets due to weaker security postures. This project deploys a targeted honeypot system using Cowrie,a medium-interaction SSH honeypot, to analyze SSH brute-force attacks and study potential ransomware tactics. By acting as a decoy, the honeypot captures attacker activity, including login attempts, command executions, andmalware injection techniques, providing valuable threat intelligence. Unlike traditional reactive securitymeasures, this proactive approach identifies attack patterns before they can be exploited. The insights gainedhelp businesses refine security strategies, strengthen authentication mechanisms, and anticipate threatswithout requiring significant financial investment. While real-time ransomware execution monitoring was not implemented due to security risks and time constraints, the honeypot remains a crucial tool incybersecurity research. The findings from this study emphasize the importance of continuous monitoring,threat intelligence gathering, and proactive security measures in mitigating evolving cyber threats.