Echidra: I built a honeypot that tells you what kind of attacker you're looking at, not just what happened

qyleron-dev — Wed, 12 Aug 2026 17:52:01 +0000

Most honeypots log what happened. Echidra tells you what kind of attacker you're looking at.

It simulates SSH, HTTP, FTP, and Telnet services with a believable Linux persona, then runs every session through a deterministic classifier — actor type, risk score, MITRE ATT&CK technique, intent — before it hits your dashboard. Nothing attackers type ever touches the real host.

Here's the part that actually mattered, and why I made the calls I did.

The part that actually solved my original problem

Every session gets run through a classifier when it ends. It's rule-based right now, not ML — a set of YAML rules that map session features to an actor type, a risk score, a MITRE ATT&CK technique, and a guess at intent. So instead of opening a log file, I open a dashboard and see which sessions were credential-stuffing bots, which were somebody manually poking around, and which looked like they were trying to establish persistence.

A rule looks roughly like this — you're matching on session features (commands run, timing, protocol) and mapping them straight to a classification:

- id: credential_stuffing_bot
 match:
   protocol: ssh
   auth_attempts: ">5"
   session_duration_seconds: "<3"
   commands_run: 0
 classify:
   actor_type: automated_bot
   risk_score: 40
   mitre_technique: T1110  # Brute Force
   intent: credential_access

Nothing fancy — no model, no training data. Just enough structure that when a session comes in with five failed logins in under three seconds and zero commands, I don't have to open a log file to know it's a script, not a person. The rules I've hand-tuned so far already sort out the obvious bots from sessions where someone is actually looking around, checking whoami, poking at /etc/passwd — the ones worth a closer look.

Setup

pip install -e .
echidra init
echidra start

That's it — runs the listeners and the dashboard together. If you don't have Postgres configured it just logs to

logs/sessions.jsonl

and still works fine, Postgres just gets you the full dashboard history.

Things I'd still call rough

The classifier rules are hand-tuned, not learned, so they're only as good as what I've seen hit my own honeypot so far. If you run one of your own I'd like to know what patterns you're seeing that this doesn't catch — new attacker behavior means new rules, and right now that loop is entirely manual.

Repo's here if you want to look at the rule engine or just run it:

Qyleron / EchidraOSS

Open-source deceptive honeypot & attacker-behavior classifier — SSH/HTTP/FTP/Telnet decoys with MITRE ATT&CK-tagged threat intelligence and a live dashboard.

Echidra — Multi-Protocol Honeypot & Attacker Behavior Classifier

Echidra is an open-source deceptive honeypot and threat-intelligence platform that simulates attacker-facing SSH, HTTP, FTP, and Telnet services, captures real attacker behavior, classifies it against MITRE ATT&CK techniques, and surfaces the result in a web dashboard — without ever executing real commands or exposing real data.

Docs & full setup guide · Console guide

What Is Echidra?

Echidra pretends to be a Linux server. Attackers connect over SSH-style TCP HTTP, FTP, or Telnet and see a believable, persona-driven system: real-looking banners, users, files, running processes, and (for the shell) an interactive fake command set. Nothing they type touches the real host or filesystem.

Every completed session is logged, classified (actor type, risk, MITRE ATT&CK technique, intent), geolocated, and stored in PostgreSQL — or logs/sessions.jsonl if PostgreSQL isn't configured — for review in the dashboard.

Features

Honeypot listeners — SSH-style fake shell, HTTP…

View on GitHub

DEV Community: qyleron-dev