实时可视化 SSH 蜜罐捕获攻击
推荐指数 41.0 NO. 019 · 2026.07.18
发布2026/07/17Score102Comments38
为什么值得看
一个可实时观看机器人与 SSH 蜜罐交互的仪表盘，展示攻击者 IP、凭证、命令和指纹等遥测数据。安全团队和 AI 工程师可借此快速理解真实攻击模式，用于威胁情报模型训练或入侵检测系统调优。
编辑判断
大多数安全团队做威胁检测模型时用的都是静态数据集如 CICIDS2017，攻击手法早已过时。这个蜜罐的实时数据流可以直接接入你的 SIEM 或用来微调异常检测模型，解决"训练数据与真实攻击脱节"的痛点。
和 Cowrie 这类传统蜜罐相比，它的价值在于可视化交互过程，适合做安全演示和快速理解攻击链。但如果你需要大规模部署蜜罐集群做数据收集，建议还是 Cowrie + ELK 的组合更成熟。
做 AI 安全产品的团队可以重点关注：把这里的实时命令序列喂给时序模型，能训练出更精准的恶意行为检测器，比基于规则的正则匹配误报率低一个数量级。
社区反馈
正面 34 条评论
核心争论：蜜罐数据公开是否应屏蔽IP以保护被入侵机器
Hi HN, I maintain several web servers and kept seeing a constant stream of SSH login attempts. At some point I became curious: what do these bots actually try to do after they get in? I set up a Cowrie SSH honeypot and built a small live dashboard around its JSON logs. Cowrie listens on port 22, a P
Hi, this is very interesting, thanks. While trying to educate myself about honeypots I came across this (https://securehoney.net/). The aggregations of popular logins and IP locations seem interesting.
From that site: Files uploaded 25,522 (46 unique) Malware uploaded 7,735 (43 unique) I wonder what 3 files were so common that they were uploaded 17,787 times instead of malware.