Adaptive Defense: Enhancing NIDS with Smart Honeypots and Attack Profiling

Abstract

The paper examines the integration of the clever honeypots with the attacker behaviour analysis to enhance the network intrusion detection in the contemporary cyberspace environment. Due to the rapid development of cyber threats, the target of traditional intrusion detection systems (that are primarily based on fixed rules and known signatures) is to identify zero-day exploits, polymorphism, malware, and advanced persistent threats. In an attempt to circumvent these constraints, the study employs a quantitative paradigm that incorporates the survey of experts, simulated honeypot logs, and machine-learning-based behaviour analysis. Honeypot data around the world show trends in the frequency of attacks and ports attacked as well as the geographic origin and time. The 4 machine-learning models, Logistic Regression, KNN, Random Forest and XGBoost, were trained and tested on the feature-engineered datasets. The ensemble techniques performed well as compared to their linear counterparts with XGBoost recording 99.96 0-percent accuracy and Rand. Forest recording a 100 percent accuracy in the dataset. The findings demonstrate that intelligent honeypots do not only collect valuable behavioural indications, but also offer highly predictive attributes to automated detecting mechanisms. The research concludes that combining honeypot intelligence with machine learning improves real-time identification, proactive defence, as well as reducing the false alarms.