Follow stream · CASE 02 · Deception · Threat Intelligence · Competition build
SocketSnoop AI
PhantomNet engine · NexaCore decoy
A decoy company that interviews its intruders.
Working prototype
Engine and decoy site are public. Built and demonstrated as a competition entry.
An AI-assisted deception honeypot. A convincing decoy company site leads attackers to a fake admin surface and an emulated shell. Every command is mapped to MITRE ATT&CK in real time, and each session produces an attacker-intelligence card.
01 Lab: talk to the decoy shell
Type what an intruder would. Each command is mapped to ATT&CK the way the engine does it.
Type a command an intruder might run, or replay the README demo.
A port of mitre_mapper.py from the nexacore-engine repository: its 36 techniques and 132 patterns, match loop, confidence heuristic and kill-chain rule, running in your browser. Nothing you type is executed or leaves this page. The full engine also scores skill, timing and re-identification, which are not shown here.
02 Brief
The problem
Most honeypots log what an attacker typed and stop there. Defenders get raw logs, not answers to the questions that matter: how skilled was this person, what were they after, is this a script or a human, and have we seen them before?
Why it matters
Deception flips the usual asymmetry. The attacker has to be right about every detail of the environment; the defender only needs them to keep talking. The longer a session runs, the more it reveals.
03 Architecture
A Python asyncio engine runs the emulated services. Analysis modules score each session as it happens, and a live dashboard shows the results over WebSockets.
- 01
NexaCore decoy
A believable real-estate company website with a fake admin panel as the lure.
- 02
Honeynet manager
Asyncio engine that emulates services (Telnet on 2323 in the demo) and streams events over WebSockets.
- 03
AI terminal
Gemini-backed shell simulation that keeps responses plausible and extends dwell time.
- 04
MITRE mapper
Maps each command to ATT&CK techniques (35+ techniques across 9 tactics) and tracks kill-chain stage.
- 05
Skill scorer
Scores each finished session 0–10 on stealth, knowledge, persistence, aggression and breadth.
- 06
Timing analyser
Separates humans from scripts and builds a typing-rhythm fingerprint.
- 07
Re-identification
Links sessions across IP or VPN changes by tool preference, attack pattern and rhythm.
- 08
Threat-intel enrichment
AbuseIPDB, VirusTotal and Shodan lookups at session end, with mock data when keys are absent.
04 Implementation
Stack
Python · asyncio · WebSockets · aiohttp · SQLite · Gemini API · AbuseIPDB · VirusTotal · Shodan · HTML/JS dashboard
My contribution
Sole committer on both public repositories (engine and decoy site).
- Service emulation and the live SOC dashboard are connected by a WebSocket event stream.
- A real-time MITRE ATT&CK mapper flashes technique tiles on the dashboard as commands arrive.
- When a session closes, a Session Intelligence Card summarises threat level, skill score, tactics used and the human-or-bot verdict.
- A returning-attacker alert fires when a new session matches an earlier fingerprint.
- Every external intelligence source degrades gracefully, so the demo runs fully offline.
05 Engineering decisions
Generate the shell, don't script it
A scripted fake shell breaks the moment an attacker strays off the expected path. A model-backed shell keeps answering in character, which is the whole point of deception.
Fingerprint behaviour, not addresses
IPs are cheap to change. Tool choice, attack order and typing rhythm are not, so re-identification is built on those.
06 Evidence
No published results yet. This file is at the working prototype stage, and results will be added once they can be backed by evidence.
Sourced from: github.com/Prathamesh0-0/nexacore-engine README; github.com/Prathamesh0-0/nexacore