Measuring and Clustering Network Attackers using Medium-Interaction Honeypots

TL;DR

This paper deploys medium-interaction honeypots across five protocols on the Internet to analyze attacker behavior, developing a clustering method to identify coordinated attacker groups and enhance threat understanding.

Contribution

It introduces a novel approach to deploying and analyzing medium-interaction honeypots for attacker clustering and behavior correlation.

Findings

Identified patterns of attacker behavior across protocols

Clustered attacker IPs likely controlled by the same operator

Demonstrated effectiveness of honeypots in threat analysis

Abstract

Network honeypots are often used by information security teams to measure the threat landscape in order to secure their networks. With the advancement of honeypot development, today's medium-interaction honeypots provide a way for security teams and researchers to deploy these active defense tools that require little maintenance on a variety of protocols. In this work, we deploy such honeypots on five different protocols on the public Internet and study the intent and sophistication of the attacks we observe. We then use the information gained to develop a clustering approach that identifies correlations in attacker behavior to discover IPs that are highly likely to be controlled by a single operator, illustrating the advantage of using these honeypots for data collection.