Why VPN access
Remote access is a boundary almost every organization keeps open, and it is also one of the deepest black boxes: traffic is encrypted, client behavior is opaque, and what an attacker tried — and how far they got — is usually reconstructed after the fact from scattered logs.
PoolScope moves that black box into a controlled environment: emulate a real VPN service, steer abnormal connections into it, and extend the server side under control so that authentication and protocol interactions are recorded end to end. The project is supported by the Junzheng Fund and runs through 2026–2027.
What the system is made of
- Honeypot service: emulates a real VPN endpoint with enough protocol fidelity that scanning and brute-force behavior happens naturally instead of being filtered out by fingerprinting.
- Authentication routing: separates ordinary probing from genuine attack attempts based on authentication behavior, and routes suspicious sessions into the controlled channel.
- Capture module: records connection behavior, authentication attempts, and protocol interaction features, keeping both logs and raw traffic so the two can be cross-checked later.
The real difficulty is encryption
There is almost no application-layer visibility inside a standard VPN tunnel, which sharply limits what network-side packet capture can tell you.
So the observation point sits on the server: sessions are extended under control so that traffic can be recovered, yielding post-decryption behavioral data. That step is the precondition for everything downstream — without it, feature engineering can only circle around connection metadata.
From behavior to a dataset
Capture is not the goal; the data has to support modeling. I run feature engineering over the attack data, arranging connection frequency, time series, and access paths into attack-behavior vectors, then aggregate them into a VPN-scenario attack-behavior dataset and feature library.
Reproducible behavioral samples are what make it possible to test whether a detection rule actually separates normal access, scanning, and brute force — otherwise the rule is just a description of one incident.