A Survey on Honeypot-Based Attack Detection: Cowrie, Threat Scoring, Automated Response and MITRE ATT&CK Mapping for SSH Intrusions

Internet-facing SSH services are continuously probed by automated scanners and brute-force bots. Honeypots such as Cowrie record these interactions in detail, but most reported deployments stop at passive observation: logs are collected, plotted or clustered offline, and the defender must still interpret the activity, decide on a response and express it in a common threat vocabulary. This paper surveys work on SSH/Telnet honeypot deployment, attacker behaviour, honeypot log analysis, honeypot detectability, adaptive honeypots and honeypot–IPS integration, and compares nine representative studies by methodology, dataset, reported results and limitations. Six research gaps are identified: passive observation without closed-loop response, missing explainable per-attacker scoring, manual mapping of behaviour to MITRE ATT&CK, detectability of default honeypots, limited evaluation realism, and per-IP views that miss distributed attackers. Finally, a honeypot-based attack detection system is outlined. It combines a Cowrie honeypot on AWS EC2 with a Python engine that stores events in SQLite, assigns rule-based threat scores, blocks high-risk IP addresses with iptables, sends Telegram alerts, maps observed behaviour to ATT&CK techniques and generates incident reports, together with a live dashboard. The prototype status is stated explicitly, and no large-scale experimental results are claimed.