# Demo: SweetsPot: A Distributed Honeypot Federation Platform

Tillmann Angeli, Frédéric Beck, Daishi Kondo, Isabelle Chrisment, Hideki Tode, Hans Schotten

## ► To cite this version:

Tillmann Angeli, Frédéric Beck, Daishi Kondo, Isabelle Chrisment, Hideki Tode, et al. Demo: SweetsPot: A Distributed Honeypot Federation Platform. Local Computer Networks (LCN), IEE, Oct 2025, Sydney, Australia. [hal-05381945](https://hal.inria.fr/hal-05381945v1)

HAL Id: hal-05381945

https://inria.hal.science/hal-05381945v1

Submitted on 25 Nov 2025

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Demo: *SweetsPot*: A Distributed Honeypot Federation Platform

Tillmann Angeli*, Frédéric Beck†, Daishi Kondo‡, Isabelle Chrisment†, Hideki Tode§, and Hans D. Schotten¶

*German Research Center for Artificial Intelligence, Kaiserslautern, Germany

†Université de Lorraine, CNRS, Inria, LORIA, F-54000 Nancy, France

‡Information Technology Center, The University of Tokyo, Tokyo, Japan

§Graduate School of Informatics, Osaka Metropolitan University, Osaka, Japan

¶Department of Electrical and Computer Engineering, RPTU Kaiserslautern-Landau, Kaiserslautern, Germany

Email: tillmann.angeli@dfki.de, frederic.beck@inria.fr, daishi.kondo@nc.u-tokyo.ac.jp, isabelle.chrisment@inria.fr, tode@omu.ac.jp, schotten@dfki.uni-kl.de

***Abstract***—Networks of honeypots, similar to network telescopes, enable the monitoring of Internet threat activity. Honeypots can collect service-specific information about threat behavior and capabilities, depending on their configuration. This demonstration paper presents *SweetsPot*, a distributed honeypot data collection system. *SweetsPot* aims to facilitate threat research to model attacker behavior and characterize emerging threats. Additionally, *SweetsPot* supports live-streaming of event data, enabling rapid analysis, visualization, and timely threat response.

***Index Terms***—Cybersecurity monitoring and analysis, Honeypot, Visualization.

## I. INTRODUCTION

Approximately 20 years ago, the Leurré.com project pioneered large-scale honeypot deployments [1], generating valuable datasets for security research [2], [3]. However, the project is no longer maintained, highlighting the need for up-to-date honeypot data to understand modern threats such as IoT-based attacks and AI-driven campaigns. Therefore, it is crucial to continuously monitor anomalous traffic using widely deployed honeypots to effectively investigate both emerging and future security threats. Sophisticated AI models, unavailable during Leurré.com operation, now offer opportunities to analyze this data and characterize evolving attacker behavior.

While many organizations utilize honeypots, data sharing is often restricted owing to privacy concerns and regulations. The Honeypot as a Service<fnref n="1" /> project offers a collaborative framework with daily data releases. Although this approach allows the monitoring of threats on a large scale, its customization and adaptation to emerging threats is limited by its standardized framework. Nevertheless, it is a valuable source for comparative analysis and dataset augmentation.

This demonstration paper introduces *SweetsPot*, a distributed honeypot federation platform. *SweetsPot* captures anomalous traffic across diverse environments (cloud, edge, home) by deploying proxies connected to different honeypots.

This proxy approach enables lightweight honeypot deployments while accounting for varied IP addresses and geolocations. The collected data facilitates cybersecurity research, improving threat detection and mitigation strategies. *SweetsPot* also supports live data analysis and visualization through centralized data management, enabling prompt responses to attacks.

## II. PLATFORM OVERVIEW

In the High Security Laboratory (HSL) [4] at Inria, we have been deploying various generations of honeypots and honeynets for over 15 years. Starting with SURFNet IDS<fnref n="2" /> in 2008 and progressing to the more recent Modern Honey Network<fnref n="3" />, we have continuously adapted to the evolution of attacks, techniques, and the availability of new honeypots and honeynets. From the outset, the distribution of probes has been a primary focus of these infrastructures.

We recently transitioned to T-Pot<fnref n="4" />, which supports various honeypots for monitoring a wide range of anomalous traffic, and utilized it as the foundation for our honeypot platform, *SweetsPot* (Fig. 1). This architecture facilitates honeypot deployment and centralizes event logging through a dedicated administration network. Collected data are stored and analyzed on servers within a separate analysis network. All events, datasets, and dashboards are accessed via a dedicated user VPN. A separate honeypot VPN allows secure connection to remotely deployed honeypots. T-Pot sensors and honeypots are deployed on remote nodes, with all events logged via VPN tunnels. Lightweight proxies, also deployed on remote nodes, forward traffic to the honeypots via point-to-point VPN tunnels. The honeypots log events directly to the collector through the administration network.

This proxy approach offers several advantages. Proxies minimize the resource burden on remote nodes, streamlining deployment and ensuring consistency in honeypot versioning and configuration. Additionally, it facilitates PCAP and NetFlow collection without overloading remote nodes, particularly

This work has been carried out within the context of the Inria Associate Team DeceptIA. This work was supported by JSPS KAKENHI Grant Number JP21H04878 and JP21K17741 and Castle (16KIS1906K).

<footnote n="1">¹https://haas.nic.cz/</footnote>

<footnote n="2">²https://sourceforge.net/projects/surfnetids/</footnote>

<footnote n="3">³https://github.com/pwnlandia/mhn</footnote>

<footnote n="4">⁴https://github.com/telekom-security/tpotce</footnote>
<figure><img src="image_2.png" /><figcaption>Fig. 1. Overview of the *SweetsPot* architecture.</figcaption></figure>

beneficial for cloud deployment. The lightweight proxies enable rapid setup, seamless migration, and effective evasion of IP deny lists by dynamically relocating proxies. This creates shifting, unpredictable targets that make it challenging for attackers to detect the honeypots. Furthermore, the minimal resource requirements significantly reduce deployment costs.

<figure><img src="image_3.png" /><figcaption>Fig. 2. *SweetsPot* real-time indexing and streaming.</figcaption></figure>

Real-time event processing allows for immediate indexing in an Elasticsearch cluster and simultaneous streaming through

a RabbitMQ<fnref n="5" /> message broker (Fig. 2). This ensures data are available for visualization and analysis within seconds.

### III. STATISTICS

We present the findings from six different T-Pot honeypot instances that ran from April 5 to April 15, 2025, across four geographical regions: France (academic and home networks), Japan (Tokyo), Germany (Frankfurt), and the United States (California). All instances had similar configurations but operated in different network environments. Notably, the three sensors deployed in France included two located in a research center and one at a private Internet service provider, and were part of the *SweetsPot* framework, with one sensor on the academic network being deployed using *SweetsPot*'s proxy. In contrast, the remaining three sensors in Japan, Germany, and the United States were installed on standalone AWS infrastructure and were not yet integrated into the *SweetsPot* framework. Future efforts will focus on integrating all sensors into the *SweetsPot* framework to ensure consistency and comparability across environments.

During the collection period, the majority of observed attacks targeted the instances in France, totaling over 3 million interactions. The highest volumes were recorded on the two instances in the research center network, with approximately 1.5 million and 1.1 million interactions, respectively. The home network, which was only operational about two-thirds of the time, recorded a moderate volume with only ~460,000 interactions. In contrast, the AWS-based sensors recorded significantly fewer attacks, ~65,000 in Frankfurt, ~110,000 in Tokyo, and ~265,000 in California.

The targeted ports and honeypots behind them were similar in all regions. Cowrie (SSH/Telnet) was consistently among the honeypots with the most interactions. Honeytrap dominated on AWS, while academic networks in France heavily targeted Cisco ASA services. Port distribution on AWS focused on SSH (20), Telnet (23), and HTTP (80), while in France there was significant activity on VNC (5900), SMB (445), and SIP (5060).

For the AWS-hosted sensors in Tokyo, Frankfurt and California, the most frequently observed autonomous systems were ASN 8075 (Microsoft Corporation) and ASN 396982 (Google LLC), both of which consistently appeared among the top three sources in all three regions. The Frankfurt sensor also recorded ASN 16509 (Amazon.com, Inc.) and ASN 4837 (China Unicom) as prominent sources. Among the installations on the French networks, ASN 16276 (OVH SAS) appeared on both the academic and private networks. The academic sensors also registered high traffic from ASN 401116 (Nybula LLC) and ASN 37153 (Xneelo (Pty) Ltd). In the home network, on the other hand, ASN 213194 (Nechaev Dmitry Sergeevich) and ASN 8151 (UNINET) were among the top sources. Overall, the AWS-based sensors showed more consistent patterns in ASN distribution, while the French sensors showed a greater variety of sources between their networks.

<footnote n="5">⁵https://www.rabbitmq.com/</footnote>
These observations support the assumption that the network environment influences not only the volume of attacks, but also the types of attacks and the diversity of their sources. The significantly higher interaction rates observed on the French sensors, compared to the cloud-based instances on AWS, suggest that the underlying network infrastructure plays a key role in how visible a system is to attackers and in shaping the nature of the threats it attracts. This idea is further supported by differences in the ports targeted and the range of autonomous systems observed. These patterns indicate that attackers are likely adjusting their behavior based on the characteristics of the environment in which the sensors are deployed. This experiment proved very useful to validate some of our initial thoughts on the different attacks typology we would encounter on different types of networks, and gave us valuable insights to establish a baseline and emit the first hypothesis that we will address in the next campaigns using the *SweetsPot* infrastructure.

## IV. DEMONSTRATION

During this demonstration, we will focus only on the three sensors deployed in France with identical configuration, and highlight the similarities and differences between academic and home networks in a real-time deployment of the *SweetsPot* architecture. While relying on the official T-Pot dashboards, we design and create custom visualizations such as Figs. 3 and 4.

<figure><img src="image_4.png" /><figcaption>Fig. 3. Attacks per sensor from June 22, 2025 to June 23, 2025.</figcaption></figure>

Fig. 3 shows the total number of attacks, and how they are distributed among the sensors and networks. The academic network sensors are represented in pink (*sweets-pot-hp01* deployed via a proxy) and green (*sweets-pot-hp02*), while blue shows hits against the home network sensor (*sweets-pot-hp03*). In the 24 hours represented, the home network sensor is targeted twice as much as the academic ones, except between 18:00 and 22:00, where the SSH service via the Cowrie honeypot (as seen in green in Fig. 4) has been heavily targeted on one of the academic network sensors.

<figure><img src="image_5.png" /><figcaption>Fig. 4. Honeypot distribution per sensor on June 22, 2025 from 18:00 to 22:00.</figcaption></figure>

Fig. 4 shows the distribution per honeypot across all three sensors during this time period. As the sensors are running non-stop since mid-March 2025, we will dynamically show the evolution of these threats over time. We will show the evolution of the attacks and targeted honeypots over a long period of time, to highlight recurrent patterns and the evolution of threats and attacks, which we will use to define *SweetsPot* deployment scenarios.

## V. COLLABORATIVE PLATFORM DEPLOYMENT AND ACCESS MODEL

To foster collaboration and broader participation from the cybersecurity community, our honeypot platform will be made available to qualified users under a controlled access model. Due to legal, institutional, and ethical considerations, access is granted on a case-by-case basis through data sharing or collaboration agreements to ensure responsible use and regulatory compliance.

To support meaningful data collection, the platform has specific deployment requirements. It can be deployed both in cloud environments and on-premises, depending on the user's infrastructure. Ideal participants will have access to a physical network (e.g., institutional, ISP, or enterprise infrastructure) and be able to run the platform on commodity hardware with minimum specifications of 4 GB RAM, 2 CPU cores, and sufficient storage for logs. Diverse deployment locations are especially encouraged, as they help broaden visibility into region-specific or ISP-level threat activity. Documentation and support will be provided to assist with setup and maintenance.

The platform will be jointly maintained by our teams, who will ensure continuous monitoring for availability, security, and performance. It is expected to remain operational throughout the duration of the Inria Associate Team DeceptIA, with possible extensions based on community engagement and available funding.

## VI. CONCLUSION

Our initial deployment of *SweetsPot* has demonstrated its ability to effectively identify distinct attack patterns and be-
haviors based on network topology. This insight lays the
groundwork for further research, and our next step is to
expand this study by integrating geographically distributed
probes to explore the impact of regional and cultural factors
on threat landscapes Moreover, we will focus on leveraging
AI techniques to characterize traffic patterns based on location
and network topology. By developing machine learning models
that can accurately classify and predict attack behaviors, we
aim to create vulnerable environments that can be strategically
deployed to attract and analyze specific types of threats. The
PIRAT team at Inria Rennes is developing the PoneyPot<fnref n="6" />
project, which we plan to integrate in the future to deploy these
AI-generated vulnerable environments, paving the way for a
new generation of adaptive and proactive honeypot systems
that can effectively adapt to the attackers' behavior and pre-
ferred targets. This proactive approach will enable us to refine
our understanding of the evolving threat landscape, ultimately
informing the development of more effective security measures
and countermeasures.

REFERENCES

[1] C. Leita, V. Pham, O. Thonnard, E. Ramirez-Silva, F. Pouget, E. Kirda, and M. Dacier, “The Leurre.com project: Collecting Internet threats information using a worldwide distributed honeynet,” in *Proc. 2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing*, 2008, pp. 40–57, doi: 10.1109/WISTDCS.2008.8.

[2] P. Chen, C. Laih, F. Pouget, and M. Dacier, “Comparative survey of local honeypot sensors to assist network forensics,” in *Proc. First International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE’05)*, 2005, pp. 120–132, doi: 10.1109/SADFE.2005.6.

[3] V.-H. Pham and M. Dacier, “Honeypot trace forensics: The observation viewpoint matters,” *Future Generation Computer Systems*, vol. 27, no. 5, pp. 539–546, 2011, doi: 10.1016/j.future.2010.06.004.

[4] F. Beck, A. Lahmadi, and J. François, “HSL: A cyber security research facility for sensitive data experiments,” in *Proc. 2021 IFIP/IEEE International Symposium on Integrated Network Management (IM)*, 2021, pp. 956–961.

<footnote n="6">⁶https://poneypot.inria.fr/</footnote>