Improving the DICOMHawk Medical Honeypot: Profile-Driven Deception with Fingerprinting & Sandbox

DICOMHawk is an open-source honeypot that emulates a vulnerable DICOM medical imaging server to attract and log unauthorized access attempts. The current v3.0 rewrite is functional at the core protocol level but presents a single fixed identity, lacks a web interface, has incomplete DIMSE handler coverage, and performs no analysis on attacker-submitted payloads. This project transforms DICOMHawk into a profile-driven deception platform. A profile system allows the honeypot to impersonate different medical imaging systems through YAML-backed configuration, controlling the DICOM identity, web-facing surface, and honeytrap behavior per deployment. An attacker-facing web extension built with Flask exposes realistic viewer interfaces and honeytrap endpoints, while browser and environment fingerprinting collects telemetry about attacker infrastructure. On the protocol side, the project completes missing DIMSE handlers (associate, release, abort) and adds DICOMweb (QIDO-RS, WADO-RS, STOW-RS) endpoints. A structured logging pipeline with session correlation ties DICOM, web, and fingerprint events together. A static-analysis sandbox quarantines and analyzes uploaded payloads without execution, shipping with starter YARA rules. Finally, Docker deployment is hardened for safer operation. Deliverables: Profile-based architecture with two starter profiles, attacker-facing web extension with per-profile templates, operator Web API, browser fingerprinting with correlation database, completed DIMSE and DICOMweb handlers, unified JSON event logging with session correlation, static-analysis sandbox with YARA support, and hardened Docker deployment.