Empirical analysis and statistical modeling of attack processes based on honeypots

Mohamed Kaâniche (1) , Yves Deswarte (1) , Eric Alata (1) , Marc Dacier (2) , Vincent Nicomette (1)

1 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique
2 EURECOM

Honeypots are more and more used to collect data on malicious activities on the Internet and to better understand the strategies and techniques used by attackers to compromise target systems. Analysis and modeling methodologies are needed to support the characterization of attack processes based on the data collected from the honeypots. This paper presents some empirical analyses based on the data collected from the Leurré.com honeypot platforms deployed on the Internet and presents some preliminary modeling studies aimed at fulfilling such objectives.

Mots clés: computer security; attack data; honeypots; assessment; modeling; metrics

Domaines: Performance et fiabilité [cs.PF]; Cryptographie et sécurité [cs.CR]; Modélisation et simulation

Mohamed Kaâniche, Yves Deswarte, Eric Alata, Marc Dacier, Vincent Nicomette. Empirical analysis and statistical modeling of attack processes based on honeypots. IEEE/IFIP International Conference on Dependable Systems and Networks (DSN-2006), Workshop on Empirical Evaluation of Dependability and Security (WEEDS), Jun 2006, France. pp.119-124. ⟨hal-00140367⟩