HYDRA × PDX¶

Dual-use cybersecurity pipeline — historical HYDRA SSH research, controlled web deception, and PDX security data generation.

The problem¶

In cybersecurity, a honeypot is a fake server deliberately exposed on the internet to attract attackers. You let them in, watch what they do, and learn from their techniques.

The problem is that today's honeypots are trivially detectable. An experienced attacker runs uname -r and sees the wrong kernel. Or checks /proc/1/cgroup and spots Docker traces. Tools like Cowrie — the most popular SSH honeypot — get fingerprinted in under 30 seconds.

Result: attackers disconnect instantly. Your logs are noise, not intelligence.

The hypothesis¶

What if the terminal could intelligently answer any command an attacker types — in real time, with memory, and without leaving any trace that it's fake?

And what if the captured data could automatically produce both offensive and defensive training datasets — from the same raw events?

That's what HYDRA × PDX does.

How it works¶

graph TB
    A[Historical attacker via SSH] --> B[HYDRA Honeypot Archive]
    W[Visitor / Bot / Scanner] --> X[Controlled Portfolio Decoys]
    P[Pentester via Burp] --> C[Burp Extension]
    B --> D[DataRouter]
    X --> D
    C --> D
    D --> E[Defensive stream]
    D --> F[Offensive stream]
    D --> G[Combined ReAct]
    E --> H[Fine-tuning
Unsloth / LoRA]
    F --> H
    G --> H
    H --> |feedback.yaml| B

The system has three possible data sources:

All sources can produce events in the same .pdx format. They converge into a single DataRouter that classifies each event into defensive, offensive, or both streams simultaneously.

Historical HYDRA run¶

What's in the docs¶

Links¶

• GitHub repository
• arXiv paper (coming soon)
• LinkedIn