Designing IoT Honeypots: Lessons from Seven Years of Architectural Challenges

Our presentation examines the architectural challenges encountered over seven years of building ProxyPot, a honeypot designed for modern Internet of Things (IoT) environments. Unlike traditional systems focused on HTTP traffic, IoT devices expose a diverse attack surface across protocols such as Telnet, SSH, FTP, SMTP, and DNS, requiring fundamentally different design approaches. We highlight the challenges of supporting multiple protocols within a unified architecture, including maintaining consistency, scalability, and realistic service emulation, while accommodating protocol-specific attacker behaviour. These challenges shape how effective IoT honeypots are designed and directly impact their ability to capture meaningful threat activity and support robust detection and defence strategies.