Intelligent Cyberattack Analysis of Traditional Honeypots : Cowrie Honeypot MITRE ATT&CK Mappings and Classifications Through an AI Enhanced Dashboard

Sammanfattning

This thesis investigates the integration of a fine-tuned AI model into a dashboard specialized on Cowrie honeypot attacks to improve the triage, classification, and reporting of cyberattacks. Over 14 days, a deployed honeypot captured approximately 161,000 sessions, which were parsed and filtered to isolate 133 unique, interactive attack command sequences. These attack sequences were then manually mapped to the MITRE ATT\&CK framework along with classifications and a severity score to create a training dataset to be used for fine-tuning an AI model. A base Llama-3.1-8B-Instruct model was then fine-tuned using Unsloth to automatically map these attacker commands to the MITRE ATT\&CK framework, assign severity scores and classifications, and generate plain-English summaries. Experimental cross-validation demonstrated that the fine-tuned model successfully learned common MITRE tags. However, it struggled with the more uncommon tags, demonstrating the need for larger publicly available datasets. When integrating the AI model with a customized dashboard, the system successfully filters out non-interactive background noise and provides actionable, session-level reports. The study concludes that fine-tuned AI models are effective assistive tools that combined with proper filtering drastically reduce the need for manual log analysis, allowing cybersecurity professionals to efficiently prioritize and respond to critical incidents.