Integration of Multiple Honeypots with a Security Information and Event Management (SIEM) System for Network Attack Detection

DOI

10.2991/978-94-6239-828-3_23How to use a DOI?

Keywords

Dionaea honeypot; Wazuh SIEM; multiple honeypot; multi-vector attack detection; MikroTik CHR; false positive validation; confusion matrix; reproducible security architecture

Abstract

Security monitoring fragmentation in heterogeneous service infrastructures running SMB, FTP, and HTTP simultaneously creates a wide attack surface. Per-service log isolation prevents timely identifica- tion of multi-vector attack patterns. This paper presents a documented, reproducible reference architecture that integrates two Dionaea honey- pot instances (ServiceArea and CoreArea) with Wazuh SIEM v4.14.3, managed through a MikroTik CHR 7.20.8 router on a three-zone seg- mented network topology. We developed six custom Wazuh detection rules (Rule IDs 100200-100212) before any experimental run. Each rule is keyed to the documented JSON event schema of Dionaea and justi- fied against prior literature rather than tuned to the test scenarios, to guard against the overfitting that a post-hoc rule design would risk. A MikroTik DNAT configuration redirects external TCP port 445 traffic to the CoreArea honeypot, which enables detection of the MS17–010 (CVE- 2017-0143) vulnerability from outside the local network. We measured detection performance over three repeated runs across five attack sce- narios, chosen to match the three most commonly exploited services in the honeypot literature this paper builds on. The experiment yielded 156 total alerts (75 from CoreArea, 81 from ServiceArea), a 100% detection rate, and an F1-score of 1.0. Four of the six rules were exercised by these scenarios; the remaining two are validated by construction but not yet by traffic. We did not assume the 0% false positive rate from idle lab traffic. Instead we validated it against a 5-hour baseline of 158 benign network events that explicitly included legitimate FTP, HTTP, and SMB traffic from a real production server (ServiceServer) running services identical to those targeted by the attack scenarios. We measured mean detection latency via NTP-synchronized timestamps for the two scenarios where event-to-alert pairing was unambiguous. The result, 59.1 4.0 seconds, reflects an architectural property of the one-minute log-conversion cycle rather than of the rule-matching engine in Wazuh. A controlled five- trial comparison showed manual operator identification time dropping from 22.4 3.1 minutes (standalone) to 42.3 8.7 seconds (integrated), a 96.8% efficiency improvement. We report these results together with their methodological boundaries, including small sample size, a single honeypot type, no adversarial evasion testing, and no comparison against commercial SIEM or network-wide IDS platforms. We position the con- tribution as an evaluated deployment framework rather than a claim of algorithmic novelty.

Copyright

© 2026 The Author(s)

Open Access

Open Access This chapter is licensed under the terms of the Creative Commons Attribution-NonCommercial 4.0 International License (http://creativecommons.org/licenses/by-nc/4.0/), which permits any noncommercial use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

Download article (PDF)

TY  - CONF
AU  - Nadhif Ahmad Mutawakkil Zaidan
AU  - Vera Suryani
AU  - Aulia Arif Wardana
PY  - 2026
DA  - 2026/11/04
TI  - Integration of Multiple Honeypots with a Security Information and Event Management (SIEM) System for Network Attack Detection
BT  - Proceedings of the 2026 11th International Conference on Sustainable Information Engineering and Technology (SIET 2026)
PB  - Atlantis Press
SP  - 261
EP  - 269
SN  - 2589-4900
UR  - https://doi.org/10.2991/978-94-6239-828-3_23
DO  - 10.2991/978-94-6239-828-3_23
ID  - Zaidan2026
ER  -