Reproduce “Characterizing Large-Scale Adversarial Activities Through Large-Scale Honey-Nets” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Tonia Haikal, Eman Hammad, Shereen Ismail
Researchers characterized large-scale adversarial activities by deploying a distributed honeypot network, HoneyTrap, collecting over 60 million events. The study utilized a scalable data pipeline and analyzed temporal, volumetric, and behavioral patterns, revealing dominant web service targeting, persistent SSH brute-forcing, and coordinated multi-vector attacks.
Key insights
- Adversarial activities exhibit distinct temporal patterns, with web services experiencing synchronized daily surges and SSH consistently facing persistent brute-force attempts.
- Attackers employ sophisticated tactics including coordinated multi-port attacks, rapid IP churn combined with stable infrastructure, and port-hopping to evade detection and maximize exploitation opportunities.
- A small number of "hotspot" destination IPs receive a disproportionate amount of traffic, often subject to synchronized multi-port attacks, indicating centralized targeting of persistent reconnaissance nodes.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.