SMOKESCREEN: AN ACTIVE MULTI-LAYERED HONEYPOT FRAMEWORK WITH HYBRID DETECTION AND DYNAMIC REDIRECTION SMOKESCREEN ACTIVE HONEYPOT FRAMEWORK

Abstract

Cybersecurity threats are becoming increasingly sophisticated, rendering traditional proactive defenses insufficient for timely threat detection and mitigation. Honeypots have emerged as a promising deception-based approach to study attacker behavior, yet most existing implementations remain passive, lack real-time response capabilities, and suffer from heavyweight logging infrastructures that limit their practicality in resource-constrained environments. This paper presents Smokescreen, a novel multi-layered honeypot framework that advances cyber deception research by integrating hybrid live detection, dynamic traffic redirection, and unified monitoring into a lightweight, container-native architecture. Deployed using virtualization, the system combines low-, medium-, and high-interaction honeypots with a hybrid detection layer. Suspicious traffic is automatically classified using threshold-based rules, blocked from real systems and intelligently redirected to isolated honeypot environments, while legitimate users remain unaffected. All security events are processed through a custom log shipper and OpenTelemetry, feeding into the monitoring platform for visualization and alerting. Experimental evaluation involving over 150 simulated attack sessions (including reconnaissance, brute-force, and payload injection) demonstrated 98% detection accuracy, 100% redirection success rate, and average end-to-end response time under 8 seconds. Real deployment screenshots and dashboards confirm the system’s operational effectiveness and usability. Smokescreen bridges the gap between theoretical deception techniques and practical active defense, offering a scalable, accessible blueprint for academic research, educational laboratories, and small-to-medium organizations seeking effective, low-cost cyber threat intelligence solutions.