High-Interactive Redis Honeypot with ELK Analytics

Abstract

Redis has become a popular target for cyberattacks due to its widespread use and frequent misconfigurations, creating a need for better understanding and analysis of security threats. This work presents the implementation of a high-interactive Redis honeypot that enables transparent interception and logging of all connections and commands to a Redis server. The system is based on a proxy server implemented in Go programming language, which forwards intercepted connections to an internal Redis instance while logging and analyzing all interactions in real-time through integration with the ELK stack (Elasticsearch, Logstash, Kibana). The entire solution is implemented as a containerized application using Docker technology. Experimental evaluation demonstrated that the system effectively detects various types of attacks, from simple scanning attempts to sophisticated multi-stage attacks. The developed system represents an important contribution to better understanding Redis server security challenges and demonstrates the utility of honeypots in cybersecurity threat research.