Skip to content

dionaea — HTTP

Status: Informative · evaluation proof
UHBS: v4.2.2 · Class: Web-API · Protocol: http
Target id: dionaea-http · Evaluated: 2026-07-27

Run UHQS Grade δ_C Artifacts
Quick 46.21 F 0.81 SCORECARD.txt · report.json
Full 51.14 D 0.81 SCORECARD.txt · report.json

Full run — module breakdown (analyst view)

Module Score Weight Status Notes
Module A: Protocol Fidelity 53.5 0.25 PARTIAL status=200
Module B: Behavioral Realism 82.5 0.20 PASSED survived binary blast
Module C: Telemetry Quality 55.0 0.20 PARTIAL no STIX objects found
Module D: Safety & Containment (C) 90.0 GATE PASSED UHBS_AIRGAP_ATTESTED=1 (operator attestation; not a substitute for shell probes on SSH decoys)
Module E: Scalability & Latency 55.0 0.15 PARTIAL P50=1025.6ms P95=1148.8ms P99=1162.1ms TPS_limit=150.0ms proto=http
Module F: Static Code Audit 70.0 0.20 PASSED bandit HIGH=9
Safety Gate δ_C 0.81 GATE — Containment multiplier

Full scorecard (verbatim)

====================================================================================
                  UNIVERSAL HONEYPOT BENCHMARK SCORECARD v4.0.1
====================================================================================
Target System         : dionaea-http
System Profile Class  : Web-API
Protocols             : http
Evaluation Date       : 2026-07-27
Evaluation Type       : Full-Spectrum (Static Audit + Dynamic Sandbox)
Environment           : Isolated Sandbox
------------------------------------------------------------------------------------
EVALUATION MODULE                     SCORE (0-100)    WEIGHT    STATUS
------------------------------------------------------------------------------------
Module A: Protocol Fidelity         :  53.5/100       0.25     PARTIAL (status=200)
Module B: Behavioral Realism        :  82.5/100       0.20     PASSED (survived binary blast)
Module C: Telemetry Quality         :  55.0/100       0.20     PARTIAL (no STIX objects found)
Module D: Safety & Containment (C)  :  90.0/100       GATE     PASSED (UHBS_AIRGAP_ATTESTED=1 (operator attestation; not a substitute for shell probes on SSH decoys))
Module E: Scalability & Latency     :  55.0/100       0.15     PARTIAL (P50=1025.6ms P95=1148.8ms P99=1162.1ms TPS_limit=150.0ms proto=http)
Module F: Static Code Audit         :  70.0/100       0.20     PASSED (bandit HIGH=9)
------------------------------------------------------------------------------------
SAFETY GATE MULTIPLIER                : δ_C = 0.81 (C = 90.0 < 95 — exponential penalty)
FINAL COMPOSITE SCORE (UHQS 4.0.1)      : 51.14 / 100
OVERALL EVALUATION GRADE              : GRADE D (Needs Remediation)
====================================================================================

CTI & blue-team reading

This page is the protocol-level proof hub for dionaea on http. Prefer the full run over quick for operational decisions. Numbers without the verbatim SCORECARD (or report.json) are not trustworthy citations.

Module interpretation (this protocol)

Module Score Analyst reading
A — Protocol Fidelity 53.5 Protocol speak / banner-handshake quality for keeping automated clients engaged.
B — Behavioral Realism 82.5 Post-connect realism (auth/session). Low often means credential-only or reject-by-design. CTI: treat primarily as auth/connection intelligence.
C — Telemetry Quality 55.0 How much useful telemetry the graded lab exposed to UHBS — not your SIEM maturity. Blue team: plan explicit log shipping; do not assume UHBS C equals production visibility.
D — Safety & Containment (C) 90.0 Containment/Safety Gate. Below threshold collapses UHQS via δ_C. Check δ_C carefully.
E — Scalability & Latency 55.0 Latency vs profile P95. Low can mean timeouts, tarpits, or slow handlers.
F — Static Code Audit 70.0 Static audit of the lab source tree — hygiene signal, not a full CVE program.
δ_C 0.81 Safety Gate multiplier applied to composite UHQS.
  • CTI: use Module A/B to judge engagement depth (scanner noise vs post-auth TTPs). Low B usually means credential/connection intelligence, not interactive malware staging.
  • Blue team: verify Safety Gate (Module D / δ_C) before Internet exposure; wire SIEM shipping yourself — Module C is harness visibility, not your pipeline.
  • Replication: commands live in the product tutorial; environment limits in the methodology.

Guides

Named products appear only under conformance as evaluation proof — not UHBS requirements or endorsements.