论文标题
使用中等相互作用的蜜饯测量和聚类网络攻击者
Measuring and Clustering Network Attackers using Medium-Interaction Honeypots
论文作者
论文摘要
信息安全团队通常会使用网络蜜饯来测量威胁格局以确保其网络。随着Honeypot开发的发展，当今的中型相互作用的蜜饯为安全团队和研究人员提供了一种部署这些主动防御工具，这些工具几乎不需要维护各种协议。在这项工作中，我们在公共Internet上的五个不同协议上部署了此类蜜饯，并研究了我们观察到的攻击的意图和复杂性。然后，我们使用获得的信息来开发一种聚类方法，该方法可以识别攻击者行为中的相关性，以发现很可能由单个操作员控制的IP，这说明了将这些Honeypots用于数据收集的优势。
Network honeypots are often used by information security teams to measure the threat landscape in order to secure their networks. With the advancement of honeypot development, today's medium-interaction honeypots provide a way for security teams and researchers to deploy these active defense tools that require little maintenance on a variety of protocols. In this work, we deploy such honeypots on five different protocols on the public Internet and study the intent and sophistication of the attacks we observe. We then use the information gained to develop a clustering approach that identifies correlations in attacker behavior to discover IPs that are highly likely to be controlled by a single operator, illustrating the advantage of using these honeypots for data collection.
