Skip to content

UHBS lab reports (evaluation proof)

Status: Informative
Purpose: Published, reproducible UHBS-Lab outputs for named honeypots / decoys so the community can audit, replicate, and compare grades — not so UHBS can endorse products.

UHBS is a personal open-source beta evaluation framework (v4.2.2).
Named products appear only under docs/conformance/ as evaluation proof.
A grade is not a certification, badge program, or consortium verdict.

How to use this directory

  1. Open a honeypot folder (for example espot/).
  2. Read the tutorial (exact commands we ran).
  3. Compare quick/ vs full/ artifacts (scorecards, report.json, logs, SAST).
  4. Recompute UHQS yourself with uhbs validate-scorecard / uhbs score.
  5. Optionally re-run the same Docker lab against a live target.

Index of published reports

Honeypot (proof label) Class Protocol Quick UHQS Full UHQS Tutorial
ESPot (mycert) Web-API HTTP :9200 49.34 / F 63.33 / D Step-by-step
miniprint (sa7mon) Low-Interaction PJL/raw :9100 41.83 / F 50.43 / D Step-by-step
Conpot (mushorg) ICS-SCADA Modbus :5020 44.55 / F 55.4 / D Step-by-step
Cowrie Low-Interaction SSH :2222 + Telnet :2223 (SFTP via SSH) see hub see hub Step-by-step
LLM Honeypot (Palisade) Low-Interaction SSH :2222 (Telnet off) 67.94 / D 61.17 / D Step-by-step
HoneyAgents Low-Interaction SSH :2222 (Telnet mapped, not enabled) 67.94 / D 65.24 / D Step-by-step
LLMPot (momalab) multi Modbus :5020 / S7comm :102 / HTTP :8080 see hub see hub Step-by-step
DataTrap (Thales) multi SSH / HTTP / MySQL / Redis / Telnet / PostgreSQL see hub see hub Step-by-step
Endlessh (skeeto) Low-Interaction ssh_tarpit :2222 46.55 / F 54.07 / D Step-by-step
OpenCanary (thinkst) multi HTTP / FTP / SSH / Telnet / Redis / MySQL / RDP / SIP / SNMP / NTP / TFTP / VNC / Git / SMB see hub see hub Step-by-step
Beelzebub multi SSH / HTTP / Telnet / Redis / MCP see hub see hub Step-by-step
HoneyMCP Web-API MCP :8080 43.04 / F 42.93 / F Step-by-step
GenAIPot (ls1911) Low-Interaction SMTP :25 + POP3 :110 see hub see hub Step-by-step
Trapster Community multi SSH / HTTP / FTP / Telnet see hub see hub Step-by-step
Dionaea multi FTP / HTTP / SMB see hub see hub Step-by-step

Directory layout (per honeypot)

docs/conformance/reports/<honeypot>/
├── index.md           # Summary, trust notes, links
├── TUTORIAL.md        # Step-by-step replication
├── METHODOLOGY.md     # Environment, versions, limitations
├── quick/             # UHBS_QUICK=1 / lighter Module E / often SAST skipped
│   ├── SCORECARD.txt
│   ├── report.json
│   ├── MANIFEST.json
│   ├── uhbs-run.log
│   └── run-meta.json
└── full/              # Formal TPS (e.g. 1000-sample A3), telemetry, SAST
    ├── SCORECARD.txt
    ├── report.json
    ├── MANIFEST.json
    ├── uhbs-run.log
    ├── run-meta.json
    └── static/        # bandit / semgrep / … when enabled

Quick vs full (read this before comparing grades)

quick/ full/
Intent Smoke / CI-speed demo Most realistic grade the harness can produce in Docker
UHBS_QUICK usually 1 unset
Module A timing shortened (≤50) formal (often 1000 samples)
RFC probes yes yes (strict_rfc_enforcement)
Source / Module F optional required (source-root)
SAST often --skip-sast-tools bandit / semgrep (+ trivy when available)
Telemetry dir often unset (optimistic C) mounted real logs
Safety Gate may be partial / attested stricter evidence (gateway log, honest HTTP-only D)

Do not treat a quick UHQS as production-ready evaluation. Prefer full/ for claims; use quick/ to show the pipeline works.

Trust & verification checklist

For every published run we aim to ship:

  • [x] Human scorecard (SCORECARD.txt)
  • [x] Machine report (report.json) with per-check evidence
  • [x] SHA-256 MANIFEST.json over artifacts
  • [x] Console transcript (uhbs-run.log)
  • [x] Provenance (run-meta.json: UHBS version, image digests, dates, flags)
  • [x] Replication tutorial with exact commands
  • [x] Explicit limitations (what was attested vs measured)

Verify locally:

# Integrity of the sanitized fixture (full ESPot)
uhbs validate-scorecard docs/conformance/fixtures/espot-web-api.scorecard.json --strict

# Spot-check manifest hashes for a published run
python - <<'PY'
import hashlib, json
from pathlib import Path
root = Path("docs/conformance/reports/espot/full")
man = json.loads((root / "MANIFEST.json").read_text())
for art in man["artifacts"]:
    p = root / art["path"]
    if not p.is_file():
        print("MISSING", art["path"]); continue
    h = hashlib.sha256(p.read_bytes()).hexdigest()
    ok = h == art["sha256"]
    print(("OK" if ok else "MISMATCH"), art["path"])
PY

Adding another honeypot report

  1. Create docs/conformance/reports/<id>/ with quick/ and full/.
  2. Capture artifacts via uhbs lab … --out docs/conformance/reports/<id>/<mode>.
  3. Write TUTORIAL.md + METHODOLOGY.md + run-meta.json.
  4. Link the row in this index and in ../index.md.
  5. Optionally add a sanitized fixture under ../fixtures/.