Home › Docs ›Reference › Glossary

Glossary

Definitions of key terms and concepts

Start here Core concepts Honeypot, IDS, SIEM, CVE and WSTG — the vocabulary the rest of the documentation assumes. Signals Detection terms SID, risk score, threshold, decay, permaflag, offense, honeytoken and GDPR signature. Modules Architecture terms Pure module, adapter module, pool, escalation and sticky routing. Decisions Scoring terms Stage 6, shared address, IP reputation cap and decision trace. Running it Operations terms Hardening, runbook, blind pentest and internal test secret.

Core Concepts

Term	Definition
Defensive Security	The project's entire scope: observing, diverting, hardening and recording on the defender's own infrastructure to protect the real store. It purposely performs no offensive tracking and no offensive security — no hack-back, no callbacks or beacons to adversary machines, no retaliation. Deception is used only to defend, never to strike back.
Security Platform (direction)	The intended evolution of the project: from today's high-interaction honeypot into a security management layer above WordPress + WooCommerce instances, unifying detection, diversion, hardening and observability. See the Roadmap.
Honeypot	Decoy system designed to attract and engage adversaries. The reverse proxy diverts suspicious requests to isolated honeypot pool instances running fake WordPress environments.
IDS	Intrusion Detection System — Suricata network IDS, which generates eve.json alerts parsed by suricata_rules.lua.
SIEM	Security Information and Event Management — Elasticsearch/Kibana stack for log ingestion and visualization.
CVE	Common Vulnerabilities and Exposures identifier — used to name specific seeded vulnerability patterns.
WSTG	OWASP Web Security Testing Guide — category system used to classify detection patterns.

Detection Terms

Term	Definition
SID	Suricata rule identifier — allocated in suricata.md (1000001-1000070+).
Risk Score	Accumulated threat score (0-100) computed by pattern_analyzer.analyze_request().
Honeypot Threshold	Minimum risk score (default 80) that triggers honeypot routing.
Decay	Exponential reduction of stored risk scores over time since last suspicious signal.
Permaflag	Score stops decaying entirely — triggered by permaflag_offenses (5) or permaflag_score (100).
Offense	Counter bumped once per recorded attack signal, used by decay_policy to slow decay.
Honeytoken	Fake high-value artefact (API key, DB credentials, admin password, S3 URL, JWT secret) planted in honeypot responses — a later request carrying one confirms compromise with high confidence.
GDPR Signature	Consent-gated, privacy-preserving one-way hash of browser characteristics (plus the server-observed IP) used as a second identifier that survives a cookie and storage wipe. See Device & GDPR Signature.
Sophistication Class	Weighted classification of a session as `scripted`, `ai_assisted`, `manual` or `unknown`, produced by `sophistication_analyzer.lua` with a confidence margin.
`eve.json`	Suricata's structured JSON event log; parsed by `suricata_rules.lua` into alert records and severity-graded score deltas (replaced the older `fast.log` regex path).
Prompt-Injection Probe	A check (`prompt_injection_filter.lua`) that scores attempts to manipulate an LLM-backed consumer of the logs; contributes `filter risk / 2` to the request score. Run as the 7th scoring signal inside `pattern_analyzer.lua` — a separate, internal numbering from the routing pipeline's own Stage 7.

Architecture Terms

Term	Definition
Pure Module	Lua module with no ngx.* dependency, plain-lua-interpreter testable (all *_rules.lua files).
Adapter Module	Lua module performing I/O, delegating decisions to pure modules.
Pool	Isolated honeypot environment (honeypot_eshop_N + honeypot_database_N) assigned per user session. See the Engine page.
Per-Session Segmentation	Telling visitors apart by session (signed cookie + fingerprint) rather than by IP, so several users behind one address — or one clearing cookies — are each isolated on their own pool.
Honeypot Layer	Where deception happens: reverse-proxy level (separate decoy backends / pools) or database level (one eshop, production vs honeypot database swapped per request). See Honeypot Layers.
Escalation	Gradual increase in response to repeated suspicious signals.
Sticky Routing	Once honeypot_bound, all subsequent requests locked to same honeypot pool.
Static Pool	A pool (numbers 1..`STATIC_POOL_COUNT`, default 3) declared in compose and always running, so there is warm capacity before the pool manager builds any runtime pools.
Pool Autoscaling	Runtime creation of pools above the static count — one per waiting session plus spares — within a memory / CPU / count budget (`POOL_MAX`, `POOL_MAX_MEMORY_MB`, `POOL_MAX_CPUS`), with idle pools retired after `POOL_IDLE_TIMEOUT_SECONDS`. See the Engine page.

Scoring Terms

Term	Definition
Stage 6	IP reputation gate in router.lua — diverts IPs scoring >50 on address's own reputation.
Shared Address	Public IP shared by multiple sessions (NAT) — detected via shared_ip_rules.
IP Reputation Cap	Maximum score an address's reputation can contribute per request on shared addresses (default 10).
Decision Trace	Flat strings logged to Nginx security access log by router_rules.decision_trace(), parsed by Vector into Kibana fields.

Operations Terms

Term	Definition
Hardening	Security posture improvements for production deployment.
Runbook	Operational troubleshooting and response procedures.
Blind Pentest	External adversary assessment where the tester has no prior knowledge of the deployment or routing logic. See Blind Pentest.
Internal Test Secret	Shared secret (`INTERNAL_TEST_SECRET`) gating the `X-Route-Target` / `X-Risk-Score` diagnostic headers; fail closed when unset, so a blind tester cannot read their own routing/score oracle.
SIEM Pipeline	The log path `Nginx / Suricata → Vector → Elasticsearch → Kibana`; in a two-host deployment the Vector hop is secured with mutual TLS. See SIEM.
Honeypot Layer	Reverse-proxy deception (separate decoy pools) vs database deception (one eshop, DB swapped per request). See Honeypot Layers.