Attacker Attribution via Characteristics Inference Using Honeypot Data

Abstract

Increasingly, the computer networks supporting the operations of organizations face a higher quantity and sophistication of cyber-incidents. Due to the evolving complexity of these attacks, detection alone is not enough and there is a need for automatic attacker attribution. This task is currently done by network administrators, making it slow, costly and prone to human error. Previous works in the field mostly profile attackers based on external tools or lists of rules that need to be updated regularly. Some tackle this problem through particular methodologies that cannot be easily generalized to any data source. We focus on using a self-sufficient technique that allows us to characterize attackers through motivation, resourcefulness, stealth, intention and originality. Furthermore, we show that this technique can easily be used on several protocols by applying it to a dataset consisting of real attacks performed on several honeypots. We show that more than 90% of the recorded data is relatively harmless and only a limited number of attackers are alarming. This process enables network administrators to readily discard benign traffic and focus their attention towards high-priority attacks.