Benchmarking Cyber Deception: Why Legacy Honeypots Fail Under High Concurrency (And How EchidraOSS Fixes It)

Description and use

Legacy honeypots struggle with high concurrency, causing CPU spikes and memory growth. EchidraOSS uses an async FastAPI event loop and deterministic in‑process classification to handle bursts efficiently, keeping CPU below 20 % and RAM around 90 MB, while providing real‑time MITRE ATT&CK mapping.

Problem

Legacy honeypots struggle with high concurrency, leading to dropped connections, high CPU usage, and memory bloat during burst traffic from botnets and scanners.

Outcome

EchidraOSS handles high-concurrency bursts with <20 % CPU usage and ~90 MB RAM, compared to legacy tools that spike near 100 % CPU and 180 MB RAM. It provides real-time, deterministic threat classification without post-processing.

Workflow

• 1. Deploy EchidraOSS via Docker Compose on a 1 vCPU, 1 GB VPS.
• 2. Configure listeners for desired protocols (SSH, HTTP, FTP, Telnet).
• 3. Run load tests or observe real traffic; the async event loop handles bursts without CPU spikes.
• 4. Sessions are classified in‑process at close, assigning actor, intent, risk score, and MITRE IDs.
• 5. View grouped issues in the Intelligence dashboard with evidence, recommended fixes, and impact summaries.

Evidence

CPU utilization over time under a simulated connection flood, thread-per-connection versus async event loop.

Source

RAM usage of the full stack, legacy Twisted/threaded honeypots versus EchidraOSS's FastAPI async stack.

Source

EchidraOSS classifies sessions natively, at capture time, using a deterministic rule engine.

Source