AUTOMATED SYSTEM OF ISOLATED EMULATION ENVIRONMENTS FOR CYBER THREAT RESEARCH

Abstract

The article examines the application of Cyber Deception technologies for the investigation of modern cyber threats and the analysis of the behavior of potential cyber attackers. The relevance of using honeypot systems as an effective tool for collecting information on unauthorized access attempts, studying contemporary cyberattack techniques, and improving cybersecurity mechanisms is substantiated. It is demonstrated that Cyber Deception technologies enable the creation of controlled emulation environments in which the behavior of potential attackers can be investigated without compromising real information infrastructure.

The purpose of this study is to analyze technologies for constructing isolated emulation environments and to develop a laboratory system for cyber threat research based on honeypot technologies. The paper presents an analysis of current approaches to the development of Cyber Deception systems, the classification of honeypots according to the level of attacker interaction, the specific features of their application in cybersecurity systems, and their potential use in research and educational activities. An architecture of a laboratory environment based on a virtual infrastructure using the Cowrie honeypot system is proposed. The developed solution provides automated event log collection and enables continuous monitoring of unauthorized access attempts, authentication processes, executed commands, and subsequent analysis of attacker activities.

Experimental evaluation demonstrated that the vast majority of recorded attacks were automated and followed common compromise scenarios, including dictionary-based password guessing, the use of default user accounts, and command execution after successful authentication. The results confirm that the proposed honeypot environment effectively accumulates experimental data on contemporary cyberattack techniques, facilitates the investigation of attacker tactics and tools, and improves the efficiency of security event log analysis. The collected data provide valuable information for understanding attacker behavior and identifying emerging attack patterns that can be used to enhance cybersecurity strategies.

The practical significance of the proposed approach lies in the development of a laboratory environment suitable for cybersecurity research, evaluation of attack detection mechanisms, accumulation of experimental datasets for improving security monitoring and incident response processes, and practical training of cybersecurity specialists. Furthermore, the proposed solution can serve as a foundation for future integration with Security Information and Event Management (SIEM) platforms, expansion of laboratory cyber ranges, and further development of proactive information security technologies.