CHARACTERIZING HONEYPOT-CAPTURED CYBER ATTACKS: STATISTICAL FRAMEWORK AND CASE STUDY

We  propose  the  first  statistical  framework  for  rigorously  analyzing 
honeypot-captured cyber attack data. The framework is built on the novel concept of 
stochastic  cyber  attack  process,  a  new  kind  of  mathematical  objects  for  describing 
cyber  attacks.  To  demonstrate  use  of  the  framework,  we  apply  it  to  analyze  a 
lowinteraction  honeypot  dataset,  while  noting  that  the  framework  can  be  equally 
applied  to  analyze  high-interaction  honeypot  data  that  contains  richer  information 
about  the  attacks.