Looking at 4 years of web honeypot attacks: tactics, ...
summary
Collection covers over 9 million events across ~52 months from hundreds of web honeypots, ingesting about 11,000 events/day into a Python/pandas/Jupyter pipeline with Elasticsearch and an automated near‑real‑time feed (≈1 day lag). Analysis finds rapid weaponization and long tails for specific CVEs including CVE-2019-11510, a shift away from widespread SQLi toward api and auth scans, and persistent command‑injection that installs crypto‑miners and botnets. Classification is mostly manual today moving toward automated ML.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:18Tools used
- 4:44Challenges
- 6:33Classification
- 8:38Goals
- 10:42Expected attacks
- 12:40Data analysis
- 16:58What we found
- 19:13Other interesting things
- 23:35Picture takeaways
related talks
35m365 Days of Cyberwar — What Attacks My Server Survived in the Past Year
45m365 Days of Cyberwar — What Attacks My Server Survived Last Year
22mPostgreSQL Threats and Attacks in the Wild
50mThe Anatomy of Cloud Attacks
52mInvestigating DDOS - Architecture Actors and Attribution
30mThe Hunt for Major League IoT-ICS Threats: A Deep Dive into IoT Threat Terrain
53mAI-equipped Threat Actors Versus AI-enhanced Cyber Tools: Who Wins?
20mCatch Attackers Before They Strike with AI-powered Threat Intelligence