An adaptive honeypot using Q-Learning with severity analyzer

In this paper, a honeypot system has been presented, which conducts a severity analysis of the adversaries who attack it. The Honeypot systems are deployed by various organizations to protect their real systems from external threats. They consist of fake file-systems that remain aloof from the attackers. Honeypots gather logs of the attacks to protect the genuine systems from attackers. However, attackers also deploy honeypot detection tools. To defer detection from the attackers, a Q-learning based on an SSH-based honeypot named Cowrie has been implemented to make it adaptive and obtain as much information as possible about the intruder. Severity analysis has been implemented to classify attacks based on their severity. This can be used by real systems to enhance their firewalls, Intrusion Detection Systems, and other security mechanisms against these threats.