DentiGrid: From Distributed Cyber Deception to Automated Threat Intelligence and Enforcement
DentiGrid is a distributed cyber-deception and threat-intelligence platform designed to transform interactions with intentionally deployed deception assets into actionable security intelligence. The platform combines distributed honeypot sensors, authenticated telemetry ingestion, edge-native processing, persistent storage, threat-intelligence enrichment, and External Dynamic List (EDL) generation for downstream security controls. The current architecture consists of Python-based honeypot sensors, an edge-based honeypot implemented using Cloudflare Workers, a Hono-based API gateway, Cloudflare Queues and D1 databases, a threat-intelligence processing pipeline, and a Next.js-based operational dashboard. Sensor telemetry is authenticated using an HMAC-SHA256 mechanism with timestamp validation and replay protection before entering the processing pipeline. DentiGrid is designed around a continuous pipeline in which attacker interaction with deception infrastructure produces telemetry that can be processed, enriched, correlated, stored, and transformed into machine-consumable threat intelligence. Generated intelligence can subsequently be exposed through EDL interfaces for integration with downstream security enforcement systems. This technical report documents the architecture, implementation, data flow, telemetry ingestion model, storage architecture, threat-intelligence pipeline, EDL mechanism, and integration model of the current DentiGrid system.