A novel honeypot solution, Beelzebub, has emerged, offering enhanced capabilities through integration with Artificial Intelligence (AI) and Large Language Models (LLMs), such as OpenAI. This approach allows honeypots to simulate more dynamic and realistic attacker interactions compared to traditional static responses. This article details the deployment of Beelzebub via Docker, its configuration, and integration with a Security Information and Event Management (SIEM) system for enhanced threat intelligence.

Understanding Honeypots and Beelzebub's AI Integration

A honeypot is a decoy system designed to attract and trap cyber attackers, enabling security professionals to observe their methods and gather intelligence without risking actual assets. Beelzebub distinguishes itself by supporting AI/LLM integration. Instead of relying on pre-scripted responses, it can connect to LLMs like OpenAI, allowing it to generate more intelligent and context-aware replies to simulated attacks. This dynamic response mechanism makes the honeypot a more convincing target for attackers.

Deployment via Docker

The deployment process for Beelzebub is demonstrated using Docker, which is presented as the most straightforward method for initial setup.

1. Prerequisites: Ensure Docker is installed and running on the host system.
2. Cloning the Repository: Navigate to the desired directory and clone the Beelzebub repository:

   git clone <repository_url>
   cd beelzebub
   

3. Building the Docker Image: Beelzebub does not currently provide a public Docker image. Therefore, the image must be built locally:

   docker compose build
   

Configuration and Services

Beelzebub utilizes YAML files for configuring various honeypot services, making customization user-friendly.

• Service Configuration: The configuration/services directory contains YAML files that define different honeypot services. Examples include:
  • An MQTT server.
  • A web server simulating WordPress over HTTP.
  • A MySQL server on port 3306.
  • An SSH server on port 2222.
• AI/LLM Integration: Beelzebub supports LLM providers, including OpenAI and local models like Ollama. This integration is configured within the service YAML files.
• Custom Prompts: Users can define custom prompts for the LLM. These prompts guide the AI's responses, allowing for specific instructions on how to format replies based on attacker input and the simulated terminal environment. For example, a prompt might instruct the LLM to act as a Linux terminal and enclose responses within a single code block.
• SSH Configuration Example: For the SSH service (port 2222), the configuration involves specifying:
  • The LLM provider (e.g., OpenAI).
  • The OpenAI API key.
  • A custom prompt for the LLM.
  • Valid passwords for root login (e.g., "root").
  • Customizable server names and SSH versions.

Launching and Testing the Honeypot

After configuring the services, the Beelzebub honeypot can be launched using Docker Compose.

1. Launching:

   docker compose up -d
   

   • Port Conflict Resolution: If an error occurs due to port 22 being in use (typically by the host's SSH service), the port entry for SSH in the docker-compose.yml file needs to be removed or modified. The Beelzebub SSH honeypot is configured to run on port 2222 by default.
2. Monitoring Logs: Container logs can be followed using:

   docker logs <container_id> -f
   

3. Connecting to the Honeypot: An SSH client can connect to the honeypot using the configured port (e.g., ssh root@<host_ip> -p 2222).
4. Simulating Attacks: Once connected, commands can be executed. These commands, along with the LLM's responses, are logged. The LLM can maintain session state, remembering previously created files or executed commands. For instance, creating a file (test.txt) and then listing its contents will show the LLM's awareness of the file's existence and content.

Integrating with WAZU for Log Management

While Beelzebub captures logs, their direct analysis can be challenging. Integrating with a SIEM like WAZU enhances log management and analysis.

1. Configuring Log Output:
   • Edit the configuration/bellsabove.yaml file to specify a log file path for JSON logs.
   • Update the docker-compose.yml file to mount this log directory as a volume to the host system.
   • Ensure the log directory is created on the host (mkdir logs).
2. Restarting Beelzebub: After configuring log output and volumes, restart Beelzebub using docker compose up -d.
3. WAZU Agent Configuration:
   • Log into the WAZU manager.
   • Navigate to Endpoint Groups and modify the relevant group (e.g., "Linux Lab").
   • In the Local File section, configure the WAZU agent to read JSON logs from the specified Beelzebub log file path. The configuration should specify log_format=json.
4. Creating WAZU Detection Rules:
   • A new detection rule needs to be created in WAZU to capture Beelzebub events. A basic rule can be added to the WAZU rules repository, specifically targeting "SSH terminal session interaction."
   • This rule should be added to the WAZU manager.
   • Restart the WAZU agent on the endpoint.

Security Considerations and Further Development

• OpenAI API Costs: Utilizing OpenAI's API incurs costs. If the honeypot is exposed publicly and receives a high volume of requests, it could lead to significant expenses.
• Rule Customization: The provided WAZU rule is basic and primarily captures SSH interactions. For comprehensive monitoring, rules need to be developed to cover other simulated services (e.g., web traffic).
• Contribution: Users are encouraged to contribute to the WAZU rules repository with new detection rules.

Beelzebub offers a powerful and customizable honeypot solution, particularly with its AI integration. It can be deployed internally to detect malicious insiders or externally to gather intelligence on attacker methodologies. The ability to customize services and integrate with LLMs provides a sophisticated layer of realism to the honeypot's behavior.