EventHorizon: Measuring Attacker Engagement in Multiprotocol IoT Tarpits

Internet-facing IoT services remain frequent targets of automated scanning and botnet propagation. While traditional defenses focus on blocking or filtering malicious traffic, tarpits aim to delay attackers by maintaining long-lived, deceptive protocol interactions. This paper presents EventHorizon, a multiprotocol IoT tarpit framework that implements protocol-aware stalling mechanisms for Telnet, MQTT, UPnP, and CoAP, alongside Endlessh, a well-known SSH tarpit. Unlike prior TCP-level tarpits, EventHorizon exploits application-layer protocol semantics and enables the first controlled comparison of TCP- and UDP-based deception across globally distributed deployments. We deployed the framework for eight weeks at three geographic vantage points, capturing 171,166 sessions from 23,927 IP addresses and accumulating approximately 19,184 days (≈ 52.56 years) of cumulative attacker engagement time. Overall, even lightweight, protocol-aware tarpits can introduce delay for automated attacks with minimal overhead and expose measurable patterns of attacker adaptation.