Cybersecurity deception technologies: integrating cowrie and ELK Stack to detect network attacks

Abstract

The article examines deception technologies in the field of cybersecurity to enhance the effectiveness of detecting attacks on network traffic. The primary objective of this work is to conduct a practical study on integrating the cowrie system, which emulates SSH and Telnet servers, with the ELK Stack platform (Elasticsearch, Logstash, Kibana) for collecting, processing, and visualizing data related to suspicious activity. The research aims to develop a method for configuring a honeypot system and integrating it into a centralized analytical system, enabling a timely response to potential threats.The research methods include the analysis of modern deception technologies and their comparison, the configuration and optimization of cowrie for collecting logs about network attacks, as well as the integration of the obtained data into the ELK Stack. To assess the effectiveness of the system, an experimental approach was employed, focusing on the types of attacks, sources of intrusions, and the behavior of attackers within the network. Data visualization in Kibana allowed for a detailed analysis of activity and the generation of operational reports on security incidents. The study's results showed that the integrated system of cowrie and ELK Stack effectively captures and classifies unauthorized access attempts, password attacks, and other typical network threats. It was found that combining trap emulation with centralized data analysis enables an increase in the speed of attack detection and enhances the understanding of attacker behavior. Configuring logging and data correlation provides a flexible approach to monitoring and security analytics.The scientific novelty of the study lies in the development of an integrated approach to applying deception technologies in cybersecurity, utilizing the honeypot cowrie and the ELK Stack data analysis platform for the detection, monitoring, and analysis of attacks on network traffic. A method for the automated collection and correlation of data on unauthorized actions is proposed, which enables an increase in the accuracy of detection and the speed of response to threats. The study demonstrates the effectiveness of integrating emulated traps with a visualization and analytics system, providing a deeper understanding of attacker behavior and the ability to predict potential scenarios of intrusions into the network infrastructure.The findings highlight that deception technologies are an effective tool for counteracting cyber threats, and their integration with analytics platforms, such as ELK Stack, significantly enhances organizations' ability to respond to incidents. Recommendations include implementing such systems in corporate and cloud environments, regularly updating honeypot configurations, and improving data visualization and analysis methods. Future directions involve automating incident response based on collected data, integrating with SIEM systems, and using machine learning to predict and prevent new types of attacks.