About this project
Description from the program archive
DICOMHawk is a honeypot system designed to emulate a vulnerable DICOM (Digital Imaging and Communications in Medicine) server, primarily to detect, analyze, and understand malicious activity targeting healthcare infrastructure. This project proposes a set of enhancements aimed at improving its operational effectiveness, observability, and deployment experience. The plan involves integrating CanaryToken webhooks to enable deception-based detection of unauthorized file access, refining the logging system with structured and enriched logs to support real-time threat monitoring, and optimizing the Docker configuration to follow best practices for security, automation, and resource efficiency. Additionally, the proposal explores simulating another protocol, such as FTP or Telnet, to broaden the attack surface and attract a wider range of adversarial behaviors. These technical enhancements will be supported by thorough documentation, testing, and monitoring setup using tools like Prometheus, Grafana, Loki, and Jaeger. Together, these contributions aim to make DICOMHawk more robust, extensible, and easier to deploy while contributing meaningfully to the field of threat intelligence in healthcare cybersecurity.