A secure low-code honeypot framework that uses AI to create high-interaction decoy systems for cyber attack detection and analysis.
Beelzebub is a secure, low-code honeypot framework that uses artificial intelligence to create virtual decoy systems for detecting and analyzing cyber attacks. It simulates high-interaction services like SSH, HTTP, and databases to lure attackers, while maintaining a secure, manageable low-interaction architecture. The framework helps security teams gather threat intelligence, identify malware, and discover vulnerabilities.
Security researchers, DevOps engineers, and cybersecurity professionals who need to deploy honeypots for threat detection, attack analysis, and building distributed threat intelligence networks.
Developers choose Beelzebub for its unique combination of low-code YAML configuration, AI-powered realism, and multi-protocol support, which simplifies deploying convincing honeypots without deep security expertise. Its built-in observability and flexible deployment options make it a practical tool for both research and production security monitoring.
A secure low code honeypot framework, leveraging AI for System Virtualization.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses modular YAML files for service definitions, simplifying setup and management without extensive coding, as detailed in the Configuration section with examples for SSH, HTTP, and other protocols.
Integrates LLMs like OpenAI GPT-4o to create convincing high-interaction experiences in SSH and TELNET honeypots, enhancing realism while maintaining secure low-interaction design, shown in the LLM Honeypot Demo.
Supports SSH, HTTP, TCP, TELNET, and MCP (for prompt injection detection), allowing comprehensive threat detection across different attack vectors, with detailed examples provided for each protocol.
Includes Prometheus metrics, event tracing to stdout/RabbitMQ/Beelzebub Cloud, and ELK stack integration, making it easy to monitor and analyze attacks without additional setup.
AI features rely on external LLM services which require API keys and incur ongoing costs, or local Ollama setup that adds deployment complexity and resource overhead, as noted in the plugin configurations.
Creating highly realistic honeypots necessitates detailed YAML configuration and custom handlers, which can be time-consuming and error-prone, especially for complex service simulations.
While examples are provided, the framework lacks an extensive library of ready-to-use honeypot configurations, pushing users to develop their own from scratch for specific use cases.