TrapShield
Turn Cyber Attacks
Into Intelligence
TrapShield is an adaptive honeypot-based cyber defence system that lures attackers, captures their activities, and uses AI/ML to detect, classify, and respond to threats in real time.
From a fake login page to a blocked IP
The same pipeline runs on every honeypot hit, end to end, with no manual triage required.
Attacker hits a decoy
A fake SSH/Telnet shell, an admin login page, or an FTP server. Each one looks real, but nothing behind it is.
Every action is captured
Commands, credentials, payloads and timing are logged and sent to the ingest API, keyed to that session.
Scored by two models
A RandomForest classifier tags the attack type and an IsolationForest flags anything unusual, blended into one risk score.
You see it, live
High-risk sessions raise an alert and can auto-block the source IP. Analyst corrections from the dashboard retrain the models.
Built as a real defensive layer
Detection & scoring
Session-level feature extraction, a RandomForest attack classifier, an IsolationForest anomaly detector, and MITRE ATT&CK mapping on every classified session.
Adaptive learning
Analysts confirm or correct predictions from the dashboard. Once enough verified samples build up, one click retrains both models.
Explainability & drift
Per-feature explanations for every classification, plus drift detection that flags when live traffic stops matching the training data.
Threat intel & active response
Offline GeoIP enrichment, optional reputation lookups, and an active-response engine that can auto-block high-risk IPs.
Decoy Mode
Turn it on and attackers who probe your protected sites get a convincing fake site, while real visitors keep using the real one. Every move they make is recorded and can be replayed, and canary tokens catch anyone who touches what they shouldn't.
Auth, roles & audit
Admin, analyst and viewer roles, optional SSO and email 2FA, separate organizations per customer, and an audit log of every security-relevant action.
Deception & honeypots
The SSH/Telnet, web-login and FTP decoys, Site Shield, and canary tokens that pull attackers in.
Machine learning
Feature extraction, the attack classifier and anomaly detector, explanations, drift checks and retraining.
Platform & dashboard
The live dashboard, organizations and roles, alerting, reporting and the public API.
See it catch something, live.
Create your organization in a minute and watch attacker sessions get scored in real time. Questions? Email us and we'll get back to you.