Construction documents for a server that does not exist. MIRAGE is a production SSH honeypot deployed on a publicly routable address. Attackers connect to what reads as a careless Ubuntu host — every credential pair, timing signal, and client fingerprint is captured and structured into open, citable threat intelligence.
nothing in this building is load-bearing →MIRAGE accepts SSH logins a real server would refuse. Behind the prompt there is no machine — only an emulated shell inside an isolated sandbox. No command ever reaches real hardware, and the system never scans, probes, or retaliates.
Every session is recorded in full — auth attempts, SSH client banner, timing in milliseconds, and working directory — to PostgreSQL. A secured REST API makes the dataset queryable in real time. A daily-updated public dashboard publishes aggregate statistics without exposing any infrastructure details.
The primary research contribution is a measurement study of automated SSH scanning behaviour: session-count clustering as a botnet detection primitive, the one-credential-per-session architecture that defeats standard rate limiting, and dedicated credential wordlists targeting blockchain validator infrastructure.
Drawn, built, and operated by two undergraduates as ongoing research. Deviations from these notes are documented in the repository, not hidden.
14:02:11 connect SSH-2.0-Go 14:02:11 auth root:345gs5662d34 14:02:11 outcome clean_disconnect duration 220ms commands 0 the large majority of sessions match this pattern: bot-driven, one credential, immediate exit. a smaller share now reach the shell and interact with it.
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--<uuid>",
"pattern": "[network-traffic:
dst_port = 22]",
"labels": ["<attacker_class>"],
"x_mirage_sessions": <count>,
"x_mirage_first_seen":
"<timestamp>"
}
STIX 2.1 bundles are generated per session by the enrichment pipeline and exposed via GET /api/sessions/{id}/report. Each bundle carries the attacker indicator, mapped ATT&CK techniques as attack-pattern objects, and relationship edges back to the sensor identity. Anonymised monthly releases are planned once the dataset reaches 90-day depth.
Single node, single geography. Frankfurt is a major peering hub — results may overrepresent European-routed traffic. The observation window is too short to characterise seasonal or campaign-level periodicity. The sensor now speaks an opt-in PROXY protocol v1 on ingest, so a future multi-node deployment behind a shared relay can still attribute sessions to their real client IP rather than the relay's — not yet exercised, since today's node is directly exposed with no relay in front of it.
Early sessions were all credential-stuffing with no shell interaction — a real gap in the sensor at the time, since it accepted any credential and couldn't be distinguished from a working login. The sensor now runs a seeded weak-credential allowlist and a simulated interactive shell, and attacker sessions do execute commands and trigger planted bait files (fake credentials, SSH keys) against it.
The emulated shell originally had no pipes or output redirection — real recon one-liners chaining `| grep` or `> file` would dead-end on the first unimplemented operator. It now parses `|` pipelines (with `grep`/`head`/`tail`/`wc` reading the piped input) and `>`/`>>`/`<` redirects, writing into a per-session filesystem overlay so one attacker's writes never leak into another's session.
ML pipeline is live. MITRE ATT&CK techniques are mapped per session and all sessions are enriched with attacker classification. Current labels are produced by an interpretable weak-label fallback — a trained classifier checkpoint is in development and will replace these once deployed.
| Credential | Count |
|---|---|
| loading… | |
| Banner | Count |
|---|---|
| loading… | |
| IPs | Credential | Client | Window (UTC) |
|---|---|---|---|
| loading… | |||
| Item | Component | Function | Status |
|---|---|---|---|
| 01 | Go | SSH emulator, session capture, fake shell | → LIVE |
| 02 | PostgreSQL | Session persistence and credential storage | → LIVE |
| 03 | REST API | Queryable threat intelligence endpoints | → LIVE |
| 04 | PyTorch | Session classification (weak-label heuristic); trained embedder implemented, awaiting deployment | → LIVE |
| 05 | STIX 2.1 | Structured intelligence export | → LIVE |
| 06 | Prometheus + Grafana | Sensor health and operational metrics | → LIVE |
| Rev | Item | Description | Status |
|---|---|---|---|
| A | Source code | Run your own sensor, read the emulator, open issues. | → ISSUED |
| B | Dataset | 100,000+ sessions with attacker classification, MITRE ATT&CK mapping, and STIX 2.1 bundles, plus a per-command commands.jsonl export (command text, response, exit code) for LLM training. Dataset updated weekly. | → ISSUED |
| C | Collaborate | Researchers, Honeynet folks, anyone who wants a sensor in a new region or wants to discuss the findings. | → OPEN |
| D | REST API | Live queryable threat intelligence. GET /api/stats, GET /api/sessions, GET /api/sessions/{id}/report with full STIX 2.1 bundle, GET /api/export/commands for paginated per-command bulk export. Key-authenticated. | → ISSUED |