LSU Cyber Lecture Series

From Knock to Shield: Open-Source Intelligence and Honeypots LSU Cyber Lecture Series From Knock to Shield: Open-Source Intelligence and Honeypots Join Darrell Miller of the Louisiana State Police Cyber Crime Unit for a fascinating look inside a honeynet research project that has captured more than 230 million hostile events. Learn practical ideas for your own security research, insight into the technical skills and tools behind the project, and a clearer understanding of how curiosity, experimentation, and careful analysis can turn the noise of the internet into useful defensive intelligence. Free and open to all! ABSTRACT What happens when you put a convincing fake refinery, medical clinic, or school district on the public internet—and watch who tries to break in? In this presentation, Darrell Miller of the Louisiana State Police Cyber Crime Unit takes students inside a honeynet research project that has recorded more than 230 million hostile events. Seven sensors impersonate fictional organizations, creating an environment where defenders can observe attacker behavior, capture malware, and study intrusion techniques without placing a real organization’s operations at risk. Using captured sessions, shell commands, and malware samples, Darrell follows the journey from an attacker’s first connection to intelligence shared with other defenders. Examples reveal how automated attacks test default passwords, survey systems for cryptocurrency mining, establish persistence, and remove competing malware. The presentation also explores attackers who tailor password guesses to fictional company names and return with credentials planted specifically to track their activity. Students will see how open-source tools, repurposed hardware, Python, and locally hosted AI support collection, analysis, and intelligence sharing. Just as importantly, the talk examines what the data cannot prove, how misleading metrics and silent system failures can distort findings, and the legal and ethical boundaries of security research. Designed for students interested in cybersecurity, computer science, and digital forensics, this session connects classroom concepts with operational work. Attendees will leave with practical research ideas, an understanding of the skills behind the project, and a clearer picture of how curiosity and careful analysis turns internet noise into useful defensive intelligence. SPEAKER BIO Darrell Miller is the Director and Senior Cyber Security Analyst for the Louisiana State Police Cyber Crime Unit, where he leads a team supporting cyber incident response, digital forensics, and threat intelligence across Louisiana. His work helps government agencies, educational institutions, businesses, and critical infrastructure organizations investigate cyberattacks, understand how intrusions occur, and strengthen their defenses. Darrell brings more than 25 years of technology experience spanning government and private industry, including extensive work in digital forensics and incident response. His background combines technical and legal training: he holds an undergraduate degree in computer science, a Juris Doctor from Louisiana State University, and a master’s degree in software engineering from Penn State. He has also served as an adjunct faculty member in LSU’s computer science program, teaching practical cybersecurity and digital forensics. Among his projects is a honeypot network designed to observe malicious activity by simulating systems and services that attackers target. His work connects captured attacker sessions, shell commands, and malware with threat intelligence that can support investigations, threat hunting, and defensive improvements. Darrell’s approach to cybersecurity emphasizes curiosity, hands-on experimentation, and a strong foundation in networking, operating systems, and scripting. For students entering the field, he brings a perspective grounded in both classroom instruction and real incident response. His presentation explores how honeypots make attacker behavior visible, and how students can use that visibility to move beyond cybersecurity theory and begin understanding what attackers actually do.