Developed a sophisticated API security system that combines an intelligent gateway with an integrated honeypot for detecting and profiling potential attackers. This system provides comprehensive protection for API infrastructures while gathering valuable threat intelligence.
Key Features & Functionalities:
API Gateway: Routes legitimate traffic to real services while directing suspicious requests to the honeypot.
Advanced Attacker Profiling: Creates detailed profiles of potential attackers by tracking behavior patterns, techniques, and preferred targets.
Session Tracking: Monitors and logs interaction patterns to build comprehensive attack signatures.
Interaction Level Analysis: Classifies attackers based on their sophistication and depth of system exploration.
Deception Techniques: Presents increasingly sensitive fake data to entice attackers to reveal more of their techniques.
Comprehensive Logging: Integrates with Grafana and Loki for real-time monitoring and analysis of attack patterns.
Technologies Used:
Containerization: Docker, Docker Compose
Programming Language: Python (Flask)
Web Server: Nginx (as an API Gateway)
Monitoring: Grafana, Loki, Promtail
Version Control: Git, GitHub