Deploying and Analysing Cloud-Based Honeypots for Threat Intelligence: A Practical Approach

Abstract

Firewalls, intrusion detection systems and antivirus tools remain the backbone of most organisational defences, yet all three share a common weakness: they operate on reactive, signature-based logic that struggles to keep pace with attacker behaviour it has not seen before. This paper reports on the deployment and empirical analysis of a cloud-based, multi-service honeypot system built on Microsoft Azure, undertaken as a practical route to generating threat intelligence that is genuinely actionable rather than merely descriptive. The system was built around the T-Pot honeypot framework, combining Cowrie (SSH/Telnet), Dionaea (HTTP and malware capture) and Conpot (ICS/Modbus), and was left exposed to live internet traffic for a continuous five-day observation window. Elasticsearch, Logstash and Kibana processed, indexed and visualised the resulting data. Over the deployment period, 31,547 unique attack attempts were captured from 8,934 distinct IP addresses spanning 67 countries; after post-processing, 26,832 of these were validated for analysis. Mapping the observed behaviour onto the MITRE ATT&CK framework showed that Active Scanning (T1595) accounted for 78% of all activity, Brute Force credential access (T1110) for 15%, and Exploitation for Client Execution (T1203) for the remaining 5%. The deployment sustained a 92% detection rate and 99.8% uptime, at a minimal operational cost that compares favourably with traditional signature-based intrusion detection on all three counts. Taken together, the findings support the view that cloud-based honeypots offer a scalable, low-cost and intelligence-rich complement to conventional security tooling, and are particularly well suited to organisations that want proactive visibility into the live threat landscape rather than a purely reactive posture.