React dashboards for DShield web honeypot logs
A honeypot feed looks chaotic until it is grouped and counted. Once the data is cut back to top IPs, common URLs, time patterns, and attack tags, the day starts to make sense. A dashboard does not need perfect coverage. It needs the right slices.
The logs are noisy, but the shape is still readable
The useful part is the repetition. One bot retries the same path, another sprays a wider set of probes, and a third keeps coming back with the same rough signature. That gives enough structure for a daily view even when the raw log stream is ugly.
Top IPs usually tell you whether this is broad scanning or a tighter campaign
A long tail of single hits points to web scanning. A short list of repeated addresses points to something narrower, or at least something less random. That difference matters because it changes how much attention the activity deserves.
A top IP table is simple, but it carries a lot of the load. It shows which sources dominate the day and whether one host keeps coming back. If a dashboard gives the same address a lot of weight across hours, that is usually not background noise.
URL clusters expose the targets the bots keep hitting
Paths repeat for a reason. WordPress probes cluster around one set of endpoints, SSRF checks around another, and traversal attempts follow their own habits. CGI abuse tends to show its own pattern too.
Grouping URLs lets the UI say something useful without showing the raw malicious string every time. The cluster is the point, not the exact payload. That is also easier to read when the same path gets hit dozens of times by different IPs.
Time spikes show when the pressure on the honeypot changes
Attack traffic is rarely flat. Bursts often show up around scans, then the line drops back into a low background level. A time chart makes that shift obvious at a glance.
The key detail is the change, not the exact minute. A steady drip of probes looks different from a spike that lasts ten minutes and then vanishes. A good dashboard makes those shifts hard to miss.
The dashboard only works if the pipeline keeps the unsafe bits out
Security telemetry is one thing. Raw hostile input is another. A model that sees unfiltered malicious strings can produce awkward output or create avoidable risk, and there is no real benefit in giving it that exposure.
Clean summaries belong in Python, not in the model prompt
The safe approach is to preprocess the honeypot logs into a compact summary before any generation step. Top IPs, top URLs, timing patterns, and attack tags are enough for the UI to stay relevant. The model does not need the original payloads.
That separation keeps the prompt focused on structure instead of toxic content. It also makes the generated dashboard easier to steer, since the input already says what matters that day. WordPress probes, SSRF, path traversal, and CGI abuse can be labelled without passing the raw strings through.
Sandboxed React output keeps generated code away from the main page
Generated UI code should not run loose in the main document. A sandboxed iframe cuts that off and keeps the damage local if the component behaves badly. That matters when the dashboard is generated from live activity and may change from one day to the next.
Serving the generated view through a backend API is a cleaner fit than dropping it straight into the client. It gives the app one place to control what gets rendered. It also keeps the React output separate from the rest of the page, which is where it belongs.
Validation and cached fallbacks stop a broken UI from taking the whole view down
Generated code breaks. Sometimes it is a small layout mistake, sometimes it is a view that refuses to render properly. The dashboard still needs to open.
Validation catches bad output before it reaches the browser. A cached copy gives the user something stable instead of a blank panel. If the generated component fails, a static fallback is the blunt fix, and it is the right one here.
A cached dashboard also avoids needless churn. The interface should reflect the day’s attack shape, but it should not change every time the page refreshes. Stability matters more than novelty when the job is threat monitoring.
