Fingerprinting Network Honeypots with Weighted Behavioral Scoring Engine

unit life — Thu, 03 Sep 2026 11:30:33 +0000

Deception technology has evolved past static string matches.
Modern decoys try to mimic production environments,
making binary "is it a honeypot?" checks unreliable.
Single indicators—like a missing Date header or an unusual SSH banner—frequently trigger false positives on enterprise middleboxes and legacy servers.

To solve this, we built Honeypot-Auditor around a dual-dimensional Honeyscore & Confidence engine. Here is a breakdown of how the scoring mechanics work under the hood.

Github: https://github.com/mziqudhd92/honeypot-auditor

The Math Behind the Honeyscore (0–100%)

Rather than assigning flat point values, Honeypot-Auditor treats each protocol anomaly as a weighted indicator with strict corroboration rules:

Isolated Indicator Penalty: Standard L4/TLS stack tells (e.g., JA3S signatures or header ordering) carry low independent weight (~10–15%).
Corroboration Multiplier: Weak tells require corroboration across independent categories (e.g., combining a TLS cipher mismatch with a state-machine failure). When two distinct categories hit, a corroboration gate unlocks the full indicator weight.
Hard Tells: High-interaction leaks (such as arbitrary auth acceptance or shell execution latency anomalies) act as high-confidence anchors that push the score above 80%.

Under the Hood: Corroboration Gating

Here is a simplified look at how the analyzer evaluates indicator weights and suppresses weak signals unless corroborated by an independent category:

def calculate_honeyscore(indicators: list[Indicator], proxy_detected: bool) -> float:
    score = 0.0
    categories_hit = {ind.category for ind in indicators if ind.triggered}

    for ind in indicators:
        if not ind.triggered:
            continue

        # Proxy Guard: Suppress L4/TLS stack tells if an edge proxy is active
        if proxy_detected and ind.fingerprint_type in PROXY_SUPPRESSED_TYPES:
            ind.suppressed = True
            continue

        # Corroboration Gate: Weak tells require at least 2 distinct categories
        if ind.requires_corroboration and len(categories_hit) < 2:
            ind.suppressed = True
            continue

        score += ind.weight

    return min(score, 100.0)

Cool Web Page: https://mziqudhd92.github.io/honeypot-auditor/

Dual-Dimensional Output: Score vs. Confidence

A high score alone isn't enough for automated decision-making. We pair the Honeyscore with a separate Confidence metric:

LOW Confidence: Triggered when < 3 protocols are audited or > 50% of probes fail/timeout.
MEDIUM Confidence: Reached when 3+ protocols respond and at least 2 distinct category hits occur.
HIGH Confidence: Achieved when deep behavioral mode confirms corroborating tells across multiple independent layers.

Real-World Scenario: The Banner Spoofing Trap

Consider a modern SSH decoy (like Cowrie,dd-honeypot and others) configured to mimic a standard production Linux server:

a. Naive Banner Grabber:

Connects to port 22 and reads the string: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1.
Concludes: "Standard production server (0% Honeypot)." b. Honeypot-Auditor:
Banner Check: Sees OpenSSH claim. (Weight: 0%)
KEXINIT Inspection: Extracts the raw SSH_MSG_KEXINIT byte sequence.
It detects Paramiko/Twisted-specific key exchange algorithms and rigid cipher preferences that real OpenSSH binaries never advertise.
Stack Cross-Referencing: Checks the TCP SYN-ACK option ordering. The underlying kernel exhibits a generic container profile, contradicting the OS claimed by the banner.
Corroboration Gate Unlocked: Combining the application-layer banner claim with the KEXINIT algorithm mismatch triggers a high-confidence indicator.
Result: Honeyscore leaps to 85.0% [HIGH LIKELIHOOD DECOY] with Tactical Action SKIP_TARGET.
And this is by checking only port 22, usually we will ffind more open ports on honeypots and combining checks on them will increase the detection even further.

Tactical Action Outcomes

Instead of forcing engineers to interpret raw percentages, the scoring engine resolves into four tactical actions:

SKIP_TARGET: Score >= 60% with HIGH/MEDIUM confidence (confirmed decoy).
PIVOT_POSSIBLE: Score < 30% with HIGH confidence (verified production target).
PROCEED_CAUTION: Score between 30–59% or LOW confidence.
INCONCLUSIVE: Edge proxy masking origin stack or insufficient probe responses.

So what is different ?
The main thing is that we are not only counting on signatures to detect a target, the engine using 16 protocols that are implementing more than 50 different strategies to evaluate if remote host is a decoy or not.

You can try it out, Honeypot-Auditor is open-source (MIT licensed:

pip install honeypot-auditor
honeypot-auditor --target 127.0.0.1 -v

mziqudhd92 / honeypot-auditor

Does This Look Like An Honeypot? (DTLLAH) Multi-protocol CLI that fingerprints whether a target IP behaves like a low-interaction honeypot — Shodan Honeyscore, active auth/state probes, and a weighted score.

.______________________________________________________________________________
|  :: H-AUDITOR :: v0.7.3 :: "DIALING IN... CARRIER DETECTED" ::                |
|------------------------------------------------------------------------------|
|  "warez? nah. headers. we trade banners, not bins."                          |
|  "if it answers any password, it ain't production — it's a lure."            |
|  "respect the sysop. probe only what you own. leave no STOR behind."         |
|______________________________________________________________________________|

Site (BBS / NFO): https://mziqudhd92.github.io/honeypot-auditor/
Agents / AEO: llms.txt · agents.md

  ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
  █  >>> LIVE DEMO · 3 HOST LAB TOUR · -v / --deep / SILENT-ACCEPT <<<     █
  ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

  "three hosts, three lenses: KEX facade with -v, deep on the buffet,
   silent-accept on the tarpit. same fingerprinter — different tells."
                                              — lab tour · authorized only

.------------------------------------------------------------------------------
|  NFO · READ BEFORE YOU DIAL                                                  |
|------------------------------------------------------------------------------|
|  Authorized targets ONLY. Lab boxes. Decoys you own. Sensors you run.        |
|  Permission on paper (or in ticket).                                         |
|                                                                              |
|  Scanning random /16 because Shodan said

…

View on GitHub

Would love feedback!

DEV Community: unit life

Fingerprinting Network Honeypots with Weighted Behavioral Scoring Engine

mziqudhd92 / honeypot-auditor

Does This Look Like An Honeypot? (DTLLAH) Multi-protocol CLI that fingerprints whether a target IP behaves like a low-interaction honeypot — Shodan Honeyscore, active auth/state probes, and a weighted score.