ThreatLens: An Intelligent IoT Honeypot for Cyber-Attack Monitoring and Threat Analysis Using ESP32

References

[1] Antonakakis M, et al. Understanding the Mirai botnet. In: Proc. 26th USENIX Security Symp., Vancouver, BC, Canada. 2017. p. 1093–1110. https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis

[2] Provos N. A virtual honeypot framework. In: Proc. 13th USENIX Security Symp., San Diego, CA, USA. 2004. https://www.usenix.org/conference/13th-usenix-security-symposium/virtual-honeypot-framework

[3] Razali MF, Razali MN, Mansor FZ, Muruti G, Jamil N. IoT honeypot: A review from researcher's perspective. In: Proc. 2018 IEEE Conf. Application, Information and Network Security (AINS). 2018. p. 93–98. https://doi.org/10.1109/AINS.2018.8631494

[4] Franco J, Aris A, Canberk B, Uluagac AS. A survey of honeypots and honeynets for Internet of Things, industrial Internet of Things, and cyber-physical systems. arXiv preprint arXiv:2108.02287. 2021. https://arxiv.org/abs/2108.02287

[5] Oosterhof M. Cowrie SSH/Telnet honeypot [Internet]. GitHub repository. https://github.com/cowrie/cowrie

[6] Mfogo VS, Zemkoho A, Njilla L, Nkenlifack M, Kamhoua C. AIIPot: Adaptive intelligent-interaction honeypot for IoT devices. arXiv preprint arXiv:2303.12367. 2023. https://arxiv.org/abs/2303.12367

[7] Samadram G. Discovering SSH attack patterns using Cowrie honeypot and k-means clustering. International Journal of Computer Applications. 2026.

[8] Wang M, Santillan J, Kuipers F. ThingPot: An interactive Internet-of-Things honeypot. arXiv preprint arXiv:1807.04114. 2018. https://arxiv.org/abs/1807.04114

[9] Hakim MA, Aksu H, Uluagac AS, Akkaya K. U-PoT: A honeypot framework for UPnP-based IoT devices. In: Proc. 2018 IEEE 37th Int. Performance Computing and Communications Conf. (IPCCC). 2018. p. 1–8. https://doi.org/10.1109/PCCC.2018.8711321

[10] Guarnizo JD, Tambe A, Bhunia SS, Ochoa M, Tippenhauer NO, Shabtai A, et al. SIPHON: Towards scalable high-interaction physical honeypots. In: Proc. 3rd ACM Workshop on Cyber-Physical System Security. 2017. p. 57–68.

[11] Vishwakarma R, Jain AK. A honeypot with machine learning based detection framework for defending IoT based botnet DDoS attacks. In: Proc. 2019 3rd Int. Conf. Trends in Electronics and Informatics (ICOEI), Tirunelveli, India. 2019. p. 1019–1024. https://doi.org/10.1109/ICOEI.2019.8862720

[12] Ellouh M, Ghaleb M, Felemban M. IoTZeroJar: Towards a honeypot architecture for detection of zero-day attacks in IoT. In: Proc. 2022 14th Int. Conf. Computational Intelligence and Communication Networks (CICN), Al-Khobar, Saudi Arabia. 2022. p. 765–771.

[13] Doshi R, Apthorpe N, Feamster N. Machine learning DDoS detection for consumer Internet of Things devices. arXiv preprint arXiv:1804.04159. 2018. https://arxiv.org/abs/1804.04159

[14] Alzaylaee MK. A systematic review of security vulnerabilities in smart home devices and mitigation techniques. arXiv preprint arXiv:2507.01018. 2025. https://arxiv.org/abs/2507.01018

[15] Irfan RS, et al. Slipper Zero+: ESP32-based Wi-Fi penetration and defense toolkit. International Journal of Engineering Research & Technology (IJERT). 2026.

@article{1724506,
      author = {Nandishwar EN, Fayaz Ahamed Shaikh, Amith Shetty, Prajna, Shiva Prasad HG},
      title = {ThreatLens: An Intelligent IoT Honeypot for Cyber-Attack Monitoring and Threat Analysis Using ESP32},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {5},
      pages = {51-60},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1724506.pdf},
      abstract = {Internet of Things devices are deployed in homes, offices, and industrial settings with little regard for the security of the firmware or the network stack running on them, and this makes them a persistent target for automated scanning, credential-stuffing, and botnet-recruitment campaigns. Most defensive research in this space relies on honeypots running on general-purpose computers or cloud instances, which do not reproduce the resource constraints or network footprint of an actual embedded device. This paper presents ThreatLens, a low-cost IoT honeypot built directly on an ESP32 microcontroller that exposes a decoy router login portal, a live ultrasonic-sensor status page, a simulated Telnet shell, and a set of common-service reconnaissance traps to attract and record unauthorized access attempts. Captured events are queued on-device and forwarded over Wi-Fi to a Flask ingestion service, which stores them in a SQLite database alongside a sliding-window rule for flagging brute-force behaviour, and a React dashboard polls the same backend to give an analyst a live view of activity. The paper describes this five-part architecture — edge firmware, log transport, backend storage, analysis, and dashboard — and reports the current implementation and validation status. The system has been built and exercised with a synthetic test harness that reproduces page views, reconnaissance probes, and brute-force sequences end to end, but it has not yet been deployed on a live network, so no field attack data is reported; we describe the test setup used so far, what it does and does not cover, and the deployment work remaining before real-world evaluation.},
      keywords = {IoT security; honeypot; ESP32; cyber-attack monitoring; threat analysis; embedded systems},
      month = {November},
      doi = {https://doi.org/10.64388/ire1724506}
  }