Fingerprinting Network Honeypots with Weighted Behavioral Scoring Engine

Deception technology has evolved past static string matches.
Modern decoys try to mimic production environments,
making binary "is it a honeypot?" checks unreliable.
Single indicators—like a missing Date header or an unusual SSH banner—frequently trigger false positives on enterprise middleboxes and legacy servers.

To solve this, we built Honeypot-Auditor around a dual-dimensional Honeyscore & Confidence engine. Here is a breakdown of how the scoring mechanics work under the hood.

---

Github: https://github.com/mziqudhd92/honeypot-auditor

1. The Math Behind the Honeyscore (0–100%)

Rather than assigning flat point values, Honeypot-Auditor treats each protocol anomaly as a weighted indicator with strict corroboration rules:

• Isolated Indicator Penalty: Standard L4/TLS stack tells (e.g., JA3S signatures or header ordering) carry low independent weight (~10–15%).
• Corroboration Multiplier: Weak tells require corroboration across independent categories (e.g., combining a TLS cipher mismatch with a state-machine failure). When two distinct categories hit, a corroboration gate unlocks the full indicator weight.
• Hard Tells: High-interaction leaks (such as arbitrary auth acceptance or shell execution latency anomalies) act as high-confidence anchors that push the score above 80%.

---

1. Under the Hood: Corroboration Gating

Here is a simplified look at how the analyzer evaluates indicator weights and suppresses weak signals unless corroborated by an independent category:

def calculate_honeyscore(indicators: list[Indicator], proxy_detected: bool) -> float:
    score = 0.0
    categories_hit = {ind.category for ind in indicators if ind.triggered}

    for ind in indicators:
        if not ind.triggered:
            continue

        # Proxy Guard: Suppress L4/TLS stack tells if an edge proxy is active
        if proxy_detected and ind.fingerprint_type in PROXY_SUPPRESSED_TYPES:
            ind.suppressed = True
            continue

        # Corroboration Gate: Weak tells require at least 2 distinct categories
        if ind.requires_corroboration and len(categories_hit) < 2:
            ind.suppressed = True
            continue

        score += ind.weight

    return min(score, 100.0)

Cool Web Page: https://mziqudhd92.github.io/honeypot-auditor/

---

1. Dual-Dimensional Output: Score vs. Confidence

A high score alone isn't enough for automated decision-making. We pair the Honeyscore with a separate Confidence metric:

• LOW Confidence: Triggered when < 3 protocols are audited or > 50% of probes fail/timeout.
• MEDIUM Confidence: Reached when 3+ protocols respond and at least 2 distinct category hits occur.
• HIGH Confidence: Achieved when deep behavioral mode confirms corroborating tells across multiple independent layers.

---

1. Real-World Scenario: The Banner Spoofing Trap

Consider a modern SSH decoy (like Cowrie,dd-honeypot and others) configured to mimic a standard production Linux server:

a. Naive Banner Grabber:

• Connects to port 22 and reads the string: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1.
• Concludes: "Standard production server (0% Honeypot)." b. Honeypot-Auditor:

• Banner Check: Sees OpenSSH claim. (Weight: 0%)

• KEXINIT Inspection: Extracts the raw SSH_MSG_KEXINIT byte sequence.
  It detects Paramiko/Twisted-specific key exchange algorithms and rigid cipher preferences that real OpenSSH binaries never advertise.

• Stack Cross-Referencing: Checks the TCP SYN-ACK option ordering. The underlying kernel exhibits a generic container profile, contradicting the OS claimed by the banner.

• Corroboration Gate Unlocked: Combining the application-layer banner claim with the KEXINIT algorithm mismatch triggers a high-confidence indicator.

• Result: Honeyscore leaps to 85.0% [HIGH LIKELIHOOD DECOY] with Tactical Action SKIP_TARGET.
  And this is by checking only port 22, usually we will ffind more open ports on honeypots and combining checks on them will increase the detection even further.

---

1. Tactical Action Outcomes

Instead of forcing engineers to interpret raw percentages, the scoring engine resolves into four tactical actions:

• SKIP_TARGET: Score >= 60% with HIGH/MEDIUM confidence (confirmed decoy).
• PIVOT_POSSIBLE: Score < 30% with HIGH confidence (verified production target).
• PROCEED_CAUTION: Score between 30–59% or LOW confidence.
• INCONCLUSIVE: Edge proxy masking origin stack or insufficient probe responses.

---

So what is different ?
The main thing is that we are not only counting on signatures to detect a target, the engine using 16 protocols that are implementing more than 50 different strategies to evaluate if remote host is a decoy or not.

You can try it out, Honeypot-Auditor is open-source (MIT licensed:

pip install honeypot-auditor
honeypot-auditor --target 127.0.0.1 -v

mziqudhd92 / honeypot-auditor

Does This Look Like An Honeypot? (DTLLAH) Multi-protocol CLI that fingerprints whether a target IP behaves like a low-interaction honeypot — Shodan Honeyscore, active auth/state probes, and a weighted score.

.______________________________________________________________________________
|  :: H-AUDITOR :: v0.7.3 :: "DIALING IN... CARRIER DETECTED" ::                |
|------------------------------------------------------------------------------|
|  "warez? nah. headers. we trade banners, not bins."                          |
|  "if it answers any password, it ain't production — it's a lure."            |
|  "respect the sysop. probe only what you own. leave no STOR behind."         |
|______________________________________________________________________________|

Site (BBS / NFO): https://mziqudhd92.github.io/honeypot-auditor/
Agents / AEO: llms.txt · agents.md

  ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
  █  >>> LIVE DEMO · 3 HOST LAB TOUR · -v / --deep / SILENT-ACCEPT <<<     █
  ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

  "three hosts, three lenses: KEX facade with -v, deep on the buffet,
   silent-accept on the tarpit. same fingerprinter — different tells."
                                              — lab tour · authorized only

.------------------------------------------------------------------------------
|  NFO · READ BEFORE YOU DIAL                                                  |
|------------------------------------------------------------------------------|
|  Authorized targets ONLY. Lab boxes. Decoys you own. Sensors you run.        |
|  Permission on paper (or in ticket).                                         |
|                                                                              |
|  Scanning random /16 because Shodan said

…

View on GitHub

Would love feedback!