EventHorizon: the tarpit framework

Project Overview

EventHorizon is an open-source multiprotocol IoT tarpit framework designed to emulate commonly abused IoT services such as Telnet, SSH, MQTT, UPnP, and CoAP in order to trap and study automated attackers. The framework focuses on keeping malicious clients engaged at the protocol level, slowing scanning and propagation activity while safely collecting measurement data. It provides a modular, containerized architecture that allows multiple protocol-aware tarpits to be deployed consistently across different environments. This GSoC project is centered on improving the framework’s capabilities, including making the codebase more robust, maintainable, and extensible for future protocol support.

Goal

Key goals include refactoring and hardening the implementation, improving reliability and logging, and addressing edge cases discovered during real-world deployments. Additional efforts focus on enhancing deployment safety, reducing predictability to attackers, and improving overall framework usability for researchers. Together, these improvements strengthen EventHorizon as a reliable foundation for studying attacker behavior and advancing deception-based defenses for IoT systems..

Required Skills

• Python programming and familiarity with Linux and Docker.