Project Chronos
A honeypot-backed mini SOC and published study of SSH, Telnet, HTTP and AWS honeytoken activity.
Question#
What does unsolicited internet traffic look like when it reaches a deliberately exposed sensor, and what happens after a scanner finds a planted AWS key?
Implementation#
Project Chronos separates an internet-facing Cowrie SSH/Telnet honeypot and HTTP canary from a SOC core on AWS. The sensor forwards JSON logs through Vector; the core normalises and classifies events, stores them in OpenSearch and Splunk, and creates session-level alerts in TheHive.
The HTTP canary assigns each source IP a consistent server persona and serves configured honeytoken bait through a .env, WordPress backup and dumpable .git repository. A CloudTrail poller records use of the planted keys. The repository includes deployment scripts, detection configuration, a replay harness, reporting scripts and published findings.
Published study#
The writeup examines the October 13–30, 2026 observation window: botnet command sequences, factory-default credentials, scanner behaviour and attempts to use the bait keys. These are observations from that collection window, not ongoing service statistics.
A key limitation is explicit: the honeytoken account was suspended, and the last successful CloudTrail read was October 20. Later bait fetches remained visible, but subsequent key use did not.