TLDR Tech / InfoSec
Knossos: Procedurally Generated Decoy Environments
Knossos is a deception engine that mines a customer's real cloud footprint for naming grammars, tag vocabularies, CIDR allocation habits, and instance family preferences, then procedurally generates a decoy AWS account whose VPCs, IAM roles, RDS instances, and Secrets Manager entries are assembled around backward-chained attack paths terminating in lure resources. Generation runs through seven deterministic stages, including a history pass that backdates synthetic audit entries to the organization's observed peak hours, three isolation layers of deny-all NACLs, permission boundaries, and a customer-applied SCP that contain the blast radius, and every lure touch emits an EventBridge event recording which breadcrumb was followed and how long the attacker dwelled at each step. The underlying techniques of pattern-derived naming, camouflage resources matched to real subnet ratios, and lure scoring as interaction rate times one minus escape rate transfer directly to homegrown honeypot builds.
Read the full story