Multi-service honeypot framework for high-fidelity cyber-attack data collection and machine learning-based threat detection in cloud environments

Modern computing systems are increasingly vulnerable owing to their development using distributed techniques, such as computing infrastructure, and the growing reliance on cloud computing. Intruders frequently breach vulnerable network services, authentication schemes, and applications. Traditional IDSs are largely signature-based, making them less effective in detecting new or unknown attack patterns. Consequently, there is a growing need to develop smart adaptive systems that can understand the realistic behavior of attackers and assist in the automatic threat detection. In this study, we present a framework for designing and deploying a multi-service honeypot environment in a cloud infrastructure for high-fidelity cyber-attack data collection. The framework is built around ten honeypot services that vary in many aspects and are well-suited for collecting realistic data from external attackers. Over 21 days, 10,900 interaction sessions were received and labelled for the proposed environment; of these, 5406 (49.6%) were classified as malicious and validated using a human-in-the-loop. The capabilities of the models were assessed using the collected data and 12 machine learning algorithms for a binary classification task (malicious and Benign-Noise sessions). The Random Forest (RF) classifier was the top-ranked model among the 12 models. Under leakage-controlled evaluation, it achieved F1 = 84.3% on a temporal holdout (trained on days 1–17 and tested on days 18–21) and F1 = 85.9% under source IP grouped (group K-fold) validation. On a blinded relabelling of 500 sessions (sampled by stratified random selection across the ten services and both classes) by two independent annotators (inter-annotator κ = 0.84), the model achieved an F1 score of 84.1%. A further control that removes the two rule-overlapping features (suspicious_keyword_hits, ip_reputation_score) yields F1 = 83.8%. The 87.5% obtained under standard 10-fold stratified cross-validation (retaining the rule features and without grouping by source IP) is reported only as an optimistic upper bound, approximately 3.2 pp inflated by the same campaign session overlap, rather than as the primary or baseline figure. After Bonferroni correction in the spirit of Nadeau–Bengio, there was no significant difference between the best ensemble trees. The framework can be reproduced to collect real data on attacks against cloud honeypots and assess intelligent intrusion-detection approaches. The system also recorded a 10.4% false-negative rate on the near-balanced honeypot dataset and was designed more as a baseline research system than one intended for production use.