## 3 Design of the Cyber Threat Hunting Platform
### Integrate and Configure the Deception Technology-Based Decoy  
To entice potential attackers targeting the smart health ecosystem, a purpose-built honeypot server was designed to mimic the behavior of a susceptible smart health data storage server. In essence, a honeypot server is a deceitful and controlled system intentionally placed within a network to imitate legitimate servers, attracting potential cyber attackers [11]. Its major duty is to continuously monitor and detect unauthorized or malicious activities, therefore providing early warning of possible security breaches. Honeypot servers are essential tools for cybersecurity research because they attract attackers and document their activity, allowing specialists to evaluate cybercriminals' strategies, techniques, and processes. They provide diversity in emulating diverse systems and services and are typically regarded as lawful and ethical, contributing proactively to cybersecurity by improving threat detection and network security [27]. Overall, honeypots can be classified according to their interaction and functionality [11; 27; 32; 33]. Low-interaction honeypots, which imitate fundamental services, are easier to install and more suited for detecting automated attacks like worms. On the other side, high-interaction honeypots give genuine operating systems for in-depth analysis of complex attack patterns, but they require more resources. Research honeypots are commonly used in universities or research environments to gather intelligence on attack strategies, whereas production honeypots are incorporated into commercial networks to increase security. Client honeypots actively seek out malicious servers targeting client applications; \begin{table}
\begin{tabular}{c c} \hline \hline
**IoT Sensor** & **Purpose** \\ \hline LM35 temperature sensor & Measures temperature in degrees Celsius \\ \hline Heart rate module & measure the heart rate in beats per minute (BPM) \\ \hline
74 HC4051 8-Channel-Mux Analog Multiplexer & combining multiple inputs into a single data stream. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: IoT sensors included in the smart health setup. server honeypots attract attacks aimed at server vulnerabilities; spam honeypots analyze spam emails; and other specialized honeypots, including database and IoT honeypots, are designed to mimic specific environments [11; 27; 32; 33]. The T-Pot honeypot employed in this study is an open-source honeypot architecture intended for cybersecurity research and threat intelligence collection [32; 33]. This comprehensive honeypot system serves as a platform for emulating many sorts of network services and systems, attracting and monitoring harmful behavior. T-Pot combines honeypots, Intrusion Detection Systems (IDSs), and Intrusion Prevention Systems (IPSs) to provide a comprehensive security solution. Overall, it has a diverse variety of honeypot components, including dionaea, cowrie, glutton, and others, allowing it to impersonate many network assets and services [32; 33]. On the other side, it contains a number of IDSs/IPSs, including Suricata, Snort, and Bro (formerly Zeek), which identify and respond to network threats and abnormalities [32; 33]. This versatility makes it an invaluable tool for researching and assessing cyber attackers' strategies, techniques, and processes, as well as recording and logging their interactions. T-pot uses specialized docker containers for multiple protocols that simulate typical vulnerable services to centralize all logs in an Elastic Stack, providing the administrator with a full front-end view of all assaults against each service. Table 3 summarizes the primary honeypot docker images given by T-Pot. T-Pot, which is widely used by cybersecurity experts and academics, was chosen due to its effectiveness in recognizing emerging threats and enhancing network defenses, making it the appropriate honeypot server for constructing the susceptible smart health environment in this study.