沙箱真实执行
基于 chroot+tempfs 的真实容器环境，捕获完整 TTPs 与恶意样本，非虚假模拟。
AI 自动研判引擎
内置 LLM + 规则引擎双层研判，支持多模型 Provider Fallback 及多渠道告警分发。
全协议覆盖
支持 SSH, HTTP, MySQL, Redis 等 12+ 种高仿真协议及自定义 YAML 配置。
分布式多节点管理
支持跨云跨机房统一管控，具备 mDNS 自动发现与心跳监控。
四级降级不丢事件
沙箱、存储、分析、FS 克隆四层独立降级链，确保系统故障时事件持续上报。
一键隧道部署
自动化 ed25519 密钥生成与远程安装，实现零手动配置的快速节点接入。
产品介绍
SmokingGun is a lightweight, high-performance, full-protocol open-source honeypot platform built in Rust. It is more than "a fake service to catch attackers" — it is a complete active defense system.
Why SmokingGun?
- 🛡️ Real Execution, Not Simulation
Traditional honeypots use pseudo-shells to simulate attacker behavior — easily spotted. SmokingGun'ssandbox isolation executes attacker commands for real inside chroot+tempfs containers, capturing complete TTPs and malware samples. High-risk events trigger automatic forensic snapshots for retrospective analysis.
- 🧠 AI-Powered Automated Triage
Built-in AI Threat Analysis Agent runs a fully automated pipeline: Ingest → Rules → LLM → Alert → Block. Supports OpenAI / Anthropic and compatible APIs with provider fallback. Dual-layer analysis (rule engine + LLM), multi-channel alerting (Webhook / DingTalk / WeCom / Email).
- 📡 Full Protocol Coverage + Zero-Conflict Deployment
12 high-fidelity protocol honeypots (SSH / HTTP / MySQL / Redis / PostgreSQL / Memcached / ES / Telnet / FTP / MQTT + YAML custom) plus a multi-protocol TCP transparent proxy. Deploys in sidecar mode alongside real services — 17MB single binary, ~10MB RSS, zero port conflicts with nginx/business services.
- 🌐 Distributed Multi-Node Management
v2.3.0 Collector control plane enables cross-cloud, cross-region unified management. Four-layer secure communication (TLS 1.3 / Token SHA-256 / Nonce replay protection / Certificate pinning), federation queries, mDNS auto-discovery, heartbeat monitoring, SQLite persistent node registry.
- 🔄 Four-Level Fallback — Zero Silent Data Loss
- Sandbox: KVM → ProcessSandbox → FakeShell
- Storage: ES Bulk → JSONL spill → retry(30s)
- Analysis: LLM → Rule engine direct output
- FS Cloning: FICLONE → clonefile → reflink → cp
Every degradation is observable. Never fail silently.
- 🔌 One-Click Tunnel Deployment
--mode tunnel-setupautomates the entire pipeline: ed25519 key generation → remote authorized_keys installation → connectivity verification. Zero manual configuration. - 📊 ECS 1.12 Standard Output
All events strictly follow Elastic Common Schema 1.12, natively compatible with ELK / SIEM / SOC data pipelines.
技术规格
| 开发语言 | Rust |
|---|---|
| 二进制体积 | ~17MB |
| 空闲内存占用 | ~10MB |
| 轻载内存占用 | <50MB |
| 支持协议数 | 12+ 协议 + 6 LLM 仿真端口 |
| TCP 威胁规则 | 24+ |
| 安全通信层级 | 4 层 (TLS / Token / Nonce / Pin) |
| ECS 版本 | 1.12.0 |
| 测试覆盖 | 30+ 单元测试 + 沙箱集成测试 |