Benchmarking Cyber Deception: Why Legacy Honeypots Fail Under High Concurrency (And How EchidraOSS Fixes It)

Описание и применение

Legacy honeypots fail under high concurrency, leading to CPU spikes and memory bloat. EchidraOSS uses an async FastAPI event loop and deterministic classification to handle bursts efficiently, keeping CPU below 20 % and RAM around 90 MB, while providing real‑time MITRE ATT&CK mapping.

Задача

Legacy honeypots struggle with high concurrency, leading to dropped connections, high CPU usage, and memory bloat during burst traffic from botnets and scanners.

Результат

EchidraOSS handles high-concurrency bursts with <20 % CPU usage and ~90 MB RAM, compared to legacy tools that spike near 100 % CPU and 180 MB RAM. It provides real-time, deterministic threat classification without post-processing.

Рабочий процесс

• 1. Deploy EchidraOSS via Docker Compose on a 1 vCPU, 1 GB VPS.
• 2. Configure listeners for desired protocols (SSH, HTTP, FTP, Telnet).
• 3. Run load tests or observe real traffic; the async event loop handles bursts without CPU spikes.
• 4. Sessions are classified in‑process at close, assigning actor, intent, risk score, and MITRE IDs.
• 5. View grouped issues in the Intelligence dashboard with evidence, recommended fixes, and impact summaries.

Доказательства

CPU utilization over time under a simulated connection flood, thread-per-connection versus async event loop.

Источник

RAM usage of the full stack, legacy Twisted/threaded honeypots versus EchidraOSS's FastAPI async stack.

Источник

EchidraOSS classifies sessions natively, at capture time, using a deterministic rule engine.

Источник