The Honeynet Project is a leading international 501(c)(3) non-profit security research organization, dedicated to investigating the latest attacks and developing open source security tools to improve Internet security. With chapters around the world, our volunteers have contributed to fight against malware (such as Confickr), discovering new attacks and creating security tools used by businesses and government agencies all over the world.
Learn More
We are very happy to announce The Honeynet Project Workshop 2025, scheduled to take place in Prague, Czech Republic, from June 2nd to 4th. The event will be hosted at the National Technical Library (NTK) and will feature a combination of cybersecurity briefings and advanced hands-on training sessions.
We are thrilled to announce The Honeynet Project Workshop 2024, scheduled to take place in Copenhagen, Denmark, from May 27th to 29th. The event will be hosted at the Mødecenter of the Technical University of Denmark and will feature a combination of cybersecurity briefings and hands-on training sessions.
Our GSoC student Dorna Raj Gyawali spent three months working under the supervision of Tim Leonhard on the GreedyBear project, focusing on introducing an Event Collector API to make it easier for external honeypots and sensors to submit IOC events to GreedyBear.
Read on for an overview of their achievements and how they successfully contributed towards GreedyBear and some considerations for the future.
Student: Dorna Raj Gyawali (drona-gyawali)
Mentors: Tim Leonhard
Contributor: Francesco Berardi
Mentors: Matteo Lodi
An analyst opens IntelOwl, types “is job #40 malicious?”, and gets back:
Job #40 is classified as malicious with a reliability score of 7 out of 10. The verdict was supported by 2 analyzers and contradicted by 1 analyzer, while the remaining 3 analyzers did not provide an opinion (silent).
No API key. No token bill. No byte of that observable ever left the machine.
That is what I built for Google Summer of Code 2026 with The Honeynet Project: a conversational interface embedded in IntelOwl, running entirely on a locally-hosted LLM. This post explains how it works, what I measured, and what did not work.
For several years The Honeynet Project has operated a network of distributed honeypots. While operating a sensor network over multiple years, we’ve improved our ability to leverage orchestration to deploy in a variety of environments, manage the various sensors, and improve them over time.
An early problem was simply how to manage honeypots running the same sensor software but deployed in very different environments. Further, the sensors needed to be lightweight and require as few resources as possible (so that we could deploy as many as possible). Luckily this effort didn’t require very much net-new orchestration and started out by relying on what had already been developed for tpot. Putting it all together, Ansible has really served as the backbone for bringing up new systems, and making it very easy to customize the sensors and deploy changes. Better yet, the effort into orchestration efforts make the individual sensors semi-disposable; their data is valuable but the sensors themselves are disposable and easily replaced by spinning up more instances.