Improving the DICOMHawk medical honeypot

Project Overview

DICOMHawk is an open-source honeypot designed to emulate a vulnerable DICOM (Digital Imaging and Communications in Medicine) server to attract, log and analyze unauthorized access attempts against medical imaging systems. It provides a realistic DICOM environment with detailed logging and a web interface for monitoring interactions, helping security researchers understand how attackers probe and interact with such services in the wild.

Goal

The GSoC project focuses on

• code improvement and debugging to make the software more robust, maintainable, and effective at capturing meaningful threat data.
• securing the honeypot itself, including hardening its deployment (e.g., through Docker and better configuration practices) so that it’s safer to run in research or production-like environments.
• general improvements to usability, monitoring, logging capabilities, and integration with threat intelligence.

Together, these efforts help evolve DICOMHawk into a more realistic, secure, and useful tool for studying attacks against healthcare infrastructure and improving defensive strategies.

Required Skills

• Basic Linux/Command Line skills
• Docker
• Python