Honeypot-Based Intrusion Detection and Logging System using Cowrie

In an era of increasing cyber threats, proactive security measures are crucial for protecting networked systems. This paper presents a honeypot-based intrusion detection and logging system using the Cowrie honeypot. Deployed within a containerized environment using Docker, our system simulates a vulnerable target to attract attackers, records their activities silently, and forwards logs to a monitoring stack comprising Promtail, Loki, and Grafana. A parallel port mirroring simulation using Cisco Packet Tracer enhances realism by showing how network traffic can be silently observed. Initial efforts also include a machine learning component aimed at classifying attacker behaviour. This setup provides a low-cost, high-visibility approach to understanding attack vectors and strengthening cybersecurity defences.