How varungandhi29/honey-profile-project works
HoneyShield is a deception-based threat defense platform: visitors encounter a simulated honeypot, their session and decoy interactions become telemetry, backend detection and risk services classify and quarantine threats, and SOC operators monitor and manage outcomes in real time. The map includes the documented AI, forensic, geo-visualization, perimeter-defense, and alerting capabilities. Source excerpts are partial, so links among unsampled feature routes and dashboard pages are limited to documented behavior and visible entry points.
Main entry points: session.js Session and Trap API · server.js HTTP Service · App.jsx Application Router · attackDetectionService.js Attack Detection
Components 25
Visitor and SOC UI
- Application Router
frontend/src/App.jsx - Deception Portal
frontend/src/pages/DeceptionDashboard.jsx - SOC Dashboards
frontend/src/pages/AdminDashboard.jsx - Live Telemetry View
frontend/src/engine/LiveDataEngine.js - Realtime Client
frontend/src/hooks/useSocket.js - Device Fingerprinting
frontend/src/utils/fingerprint.js - Threat Audio Alerts
frontend/src/audio/alertEngine.js
Threat Platform Backend
- Session and Trap API
backend/routes/session.js - Honeypot API
backend/routes/honeypot.js - Authentication API
backend/routes/auth.js - Blocklist API
backend/routes/blocklist.js - Analytics and Export
backend/routes/analytics.js - Forensic Data Vault
backend/services/dataVaultService.js - HTTP Service
backend/server.js - Realtime Broadcast
backend/services/broadcastService.js - Socket Gateway
backend/socket.js
Detection and AI
- Risk Engine
backend/services/riskEngine.js - Attack Detection
backend/services/attackDetectionService.js - IP Reputation
backend/services/ipReputationService.js - AI Prediction API
ai-service/main.py
Telemetry and State
- Cache
backend/services/cacheService.js - MongoDB Records
backend/models/Session.js - Alert Records
backend/models/Alert.js
Other components
- Adversary / User
- IP Reputation Feed
Connections 40
- Adversary / User → Application Router: opens portal
- Application Router → Device Fingerprinting: generates fingerprint
- Application Router → Authentication API: authenticates
- Application Router → Blocklist API: checks block status
- Application Router → Deception Portal: routes attacker
- Deception Portal → Session and Trap API: submits interactions
- Session and Trap API → Attack Detection: checks threats
- Session and Trap API → IP Reputation: checks IP
- Session and Trap API → Risk Engine: calculates risk
- Session and Trap API → MongoDB Records: records sessions
- Session and Trap API → Cache: reads and writes
- Session and Trap API → Forensic Data Vault: encrypts evidence
- Attack Detection → Cache: tracks behavior
- Attack Detection → IP Reputation: checks IP
- Attack Detection → MongoDB Records: blocks IP
- Attack Detection → Realtime Broadcast: dispatches block events
- IP Reputation → IP Reputation Feed: queries reputation
- Risk Engine → Cache: caches predictions
- Risk Engine → AI Prediction API: requests prediction
- AI Prediction API → Risk Engine: returns classification
- HTTP Service → Session and Trap API: mounts API
- HTTP Service → Honeypot API: mounts API
- HTTP Service → Authentication API: mounts API
- HTTP Service → Blocklist API: mounts API
- HTTP Service → Analytics and Export: mounts API
- HTTP Service → MongoDB Records: connects database
- HTTP Service → Cache: initializes cache
- HTTP Service → Socket Gateway: starts gateway
- HTTP Service → Realtime Broadcast: initializes broadcasts
- Realtime Broadcast → Socket Gateway: emits events
- Realtime Client → Socket Gateway: receives events
- Realtime Client → Live Telemetry View: updates telemetry
- Application Router → Live Telemetry View: maintains view state
- SOC Dashboards → Analytics and Export: requests insights
- SOC Dashboards → Session and Trap API: manages sessions
- SOC Dashboards → Blocklist API: manages blocks
- Analytics and Export → MongoDB Records: reads evidence
- Analytics and Export → Alert Records: reads alerts
- Session and Trap API → Alert Records: records alerts
- Application Router → Threat Audio Alerts: plays threat alerts