PaperlayerView exact revision on arXiv

Source-linked AI summary

Characterizing Honeypot-Captured Cyber Attacks: Statistical Framework and Case Study

Zhenxin Zhan, Maochao Xu, Shouhuai Xu

arXiv:1603.07433v1cs.CRstat.AP

TL;DR

The paper addresses the absence of a systematic framework for rigorously analyzing honeypot-captured cyber attack data. It introduces stochastic cyber attack processes and a framework that identifies statistical properties and uses them in gray-box prediction. Its low-interaction honeypot case study finds LRD in attacks and reports that LRD-aware models can predict attack rates, especially at network level.

  • Problem

    There is no systematic framework for rigorously analyzing the statistical properties of honeypot-captured cyber attack data, despite the potential to deepen understanding of threats and inform cyber defense.

    Source: §I · p. 1

  • Method

    The paper proposes a framework centered on stochastic cyber attack processes and gray-box prediction models that accommodate identified statistical properties.

    Source: §I · p. 1, B. The Framework · p. 4

  • Results

    The case study finds LRD in honeypot-captured cyber attacks and reports that LRD-aware models can predict attack rates, especially for network-level processes.

    Source: §I · p. 1, §VII · p. 13

  • Takeaways & Limitations

    Under the stated assumption that honeypot attacks are representative of or related to production-network attacks, predicting attack counts hours ahead could give defenders time to prepare.

    Source: D. Exploiting LRD to Predict Attack… · p. 7

    The case study uses a low-interaction dataset from 166 honeypot IP addresses over 220 cumulative days and lacks information about the specific attacks.

    Source: A. Limitation of the Case Study · p. 11

Abstract

from arXiv · show

Rigorously characterizing the statistical properties of cyber attacks is an important problem. In this paper, we propose the {\em first} statistical framework for rigorously analyzing honeypot-captured cyber attack data. The framework is built on the novel concept of {\em stochastic cyber attack process}, a new kind of mathematical objects for describing cyber attacks. To demonstrate use of the framework, we apply it to analyze a low-interaction honeypot dataset, while noting that the framework can be equally applied to analyze high-interaction honeypot data that contains richer information about the attacks. The case study finds, for the first time, that Long-Range Dependence (LRD) is exhibited by honeypot-captured cyber attacks. The case study confirms that by exploiting the statistical properties (LRD in this case), it is feasible to predict cyber attacks (at least in terms of attack rate) with good accuracy. This kind of prediction capability would provide sufficient early-warning time for defenders to adjust their defense configurations or resource allocations. The idea of "gray-box" (rather than "black-box") prediction is central to the utility of the statistical framework, and represents a significant step towards ultimately understanding (the degree of) the {\em predictability} of cyber attacks.

I. INTRODUCTION

The paper introduces a statistical framework for analyzing honeypot-captured attacks and applies it in a case study that finds LRD and explores attack-rate prediction. It defines attack processes at multiple resolutions and outlines how LRD is distinguished from spurious LRD.

I. INTRODUCTION

  • The paper addresses the lack of a systematic framework for rigorous statistical analysis of honeypot-captured cyber attack data.The authors note that such a framework requires both an abstraction of attacks and advanced statistical techniques.Source: §I · p. 1
  • The framework introduces stochastic cyber attack processes as mathematical objects for modeling attacks and poses questions about their properties, predictability, and causes.Processes can be instantiated at network, victim, or port resolution.Source: §I · p. 1
  • Honeypot-captured attack processes are not Poisson and can exhibit Long-Range Dependence (LRD), which the case study also exploits for attack-rate prediction.The authors report that the cause of the observed LRD cannot be pinned down precisely, though two possible causes are ruled out.Source: §I · p. 1

A. Long-Range Dependence (LRD)

  • LRD is characterized by slowly decaying autocorrelation, with its degree expressed by the Hurst parameter H; LRD requires 1/2 < H < 1.The relationship given is β = 2 − 2H, and the degree of LRD increases as H approaches 1.Source: A. Long-Range Dependence (LRD) · p. 2
  • Because 1/2 < H < 1 is necessary but insufficient for LRD, the framework tests for nonstationarity that could produce spurious LRD.The described alternatives include change points and smoothly varying trends.Source: A. Long-Range Dependence (LRD) · p. 2

B. Two Statistical Models for Predicting Incoming Attacks

The paper contrasts a model that cannot accommodate LRD with one that can, and defines prediction-error measures for comparing their forecasts. It also distinguishes overall error from error due to underestimation.

B. Two Statistical Models for Predicting Incoming Attacks

  • The model comparison treats ARMA and FARIMA as alternatives that respectively cannot and can accommodate LRD.ARMA is an autoregressive moving-average model; FARIMA is a fractional ARIMA model.Source: B. Two Statistical Models for… · p. 2
  • ARMA is the LRD-less model, while FARIMA is the LRD-aware model considered for prediction.FARIMA is specified with 0 < d < 1/2 and H = d + 1/2.Source: B. Two Statistical Models for… · p. 2

C. Measures of Prediction Accuracy

  • PMAD measures overall prediction error, while underestimation error counts only predictions that underestimate observed attack rates.Underestimation error is useful when defenders are more concerned about overlooked attacks and are willing to over-provision resources.Source: C. Measures of Prediction Accuracy · p. 2

III. THE STATISTICAL FRAMEWORK

The framework models attacks as stochastic processes at network, victim, or port resolution and analyzes their statistical properties through a five-step procedure. It uses identified properties for gray-box prediction and investigates possible causes through decomposition or attacker-level analysis.

A. The Concept of Stochastic Cyber Attack Processes

  • Stochastic cyber attack processes represent attacks as time-indexed random variables and can be defined at network, victim, or port resolution.A higher-level process may be a superposition of lower-level processes, which can help investigate or rule out candidate causes of an observed property.Source: A. The Concept of Stochastic Cyber… · pp. 2–3

B. The Framework

  • The five-step framework proceeds from data preprocessing and basic statistics to property identification, gray-box prediction, and cause exploration.Basic statistical analysis is intended to provide hints for advanced analysis, which then supports prediction and cause analysis.Source: B. The Framework · p. 3
  • Preprocessing distinguishes traffic for production ports from traffic for non-production ports and uses flows rather than packets to represent attacks.The authors cite missing payloads in low-interaction honeypot data and the ability of flow-based analysis to handle encrypted payloads as reasons for using flows.Source: B. The Framework · p. 3
  • Basic analysis examines attack rates and inter-arrival times, while advanced analysis tests whether processes are Poisson or exhibit other statistical properties.Burstiness can hint that a process is not Poisson and merits further analysis.Source: B. The Framework · pp. 3–4
  • Gray-box prediction fits models that accommodate identified process properties and selects the best model at each prediction step.The approach predicts attack rates at a chosen resolution and can select among models using a criterion such as AIC.Source: B. The Framework · p. 4
  • Cause exploration decomposes processes into lower-level components or examines attacks by distinct attackers, retaining only each attacker’s first attack in the latter analysis.These approaches investigate whether a property may be associated with component processes or with intense consecutive attacks by individual attackers.Source: B. The Framework · pp. 4–5

IV. CASE STUDY

The section demonstrates the framework by applying it to low-interaction honeypot data and notes that it can also be applied to high-interaction data.

IV. CASE STUDY

  • The case study applies the framework to a dataset collected by a low-interaction honeypot.Source: §IV · p. 5
  • The authors state that the framework can equally be applied to high-interaction honeypot data.Source: §IV · p. 5
  • The low-interaction dataset serves as a demonstration of the framework’s use.Source: §IV · p. 5

A. Data Pre-Processing

The study preprocesses low-interaction honeypot traffic and examines per-hour attack rates at network, victim, and port resolutions. Basic statistics show substantial variation, including intense hourly peaks and rates whose variances exceed their means.

A. Data Pre-Processing

  • The case-study dataset comprises 166 victim/honeypot IP addresses across five periods that are not strictly consecutive; preprocessing disregards non-production-port attacks, and low-interaction honeypots do not support precise identification of specific attack types.For flows without FIN or RST termination, the authors use a 60-second flow timeout and a 300-second flow lifetime.Source: A. Data Pre-Processing · p. 5

B. Basic Statistical Analysis

  • Per-hour attack rates are examined at network, victim, and production-port resolutions; per-day rates are unsuitable because each period lasts no more than 80 days.Victim- and port-level series are summarized differently because there are many more of them than network-level series.Source: B. Basic Statistical Analysis · p. 5
  • Periods III and IV contain intense hourly peaks, while I, II, and V are relatively stationary; formal analysis identifies change points only in Period III.The Period III peak involved SSH brute forcing; the Period IV peak involved HTTP, and the authors found no information linking either peak to an outbreak.Source: B. Basic Statistical Analysis · p. 5, Figure 3 · p. 6
  • At victim level, variance is at least 3.5 times the corresponding mean across 830 processes; Period I average rates range from 32–1810 attacks per hour.Period I median rates range from 8–1327 attacks per hour, and a single victim received as many as 14,403 attacks in an hour.Source: B. Basic Statistical Analysis · p. 6, Table III · p. 6
  • 14,363 attacks hit one production port within an hour; port-level attack-rate variance is much larger than the mean.The maximum was observed on port 445; the authors note that many port-level processes are heavy-tailed.Source: B. Basic Statistical Analysis · p. 6, Table IV · p. 6

C. Identifying Statistical Properties of Attack Processes

The paper tests whether attack processes follow Poisson assumptions and characterizes long-range dependence (LRD) across network, victim, and port resolutions. LRD appears in a substantial share of processes, after accounting for spurious cases caused by non-stationarity.

C. Identifying Statistical Properties of Attack Processes

  • Four of five network-level processes exhibit legitimate LRD; Period III’s apparent LRD is spurious because the process is non-stationary.The estimated Hurst parameters initially suggested LRD in all five periods, but the authors’ further analysis excluded Period III.Source: C. Identifying Statistical Properties… · p. 6, Table V · p. 7
  • Victim-level inter-arrival times fail exponential-distribution tests, and a QQ plot’s tail deviations support the conclusion that these processes are not Poisson.The tests use estimated exponential parameters and KS, CM, and AD statistics; the reported minimum test statistics exceed the critical values.Source: C. Identifying Statistical Properties… · p. 7, Figure 4 · p. 7
  • 576 of 830 victim-level processes exhibit LRD; in Period I, 159 of 166 exhibit legitimate LRD after four spurious cases are excluded.Only 87 victim-level processes exhibit LRD in Period III.Source: C. Identifying Statistical Properties… · p. 7
  • Port-level LRD counts across the five periods are 316, 397, 399, 328, and 406, corresponding to 44.5% of 4,150 processes overall.There are 830 port-level processes per period: five production ports for each of 166 victims.Source: C. Identifying Statistical Properties… · p. 7
  • LRD appears in 80% of network-level, 70% of victim-level, and 44.5% of port-level attack processes.The authors conclude that defenders should expect attack bursts to sustain and that attack processes should be modeled with LRD-aware stochastic processes.Source: C. Identifying Statistical Properties… · p. 7

D. Exploiting LRD to Predict Attack Rates

The section evaluates whether exploiting LRD improves attack-rate forecasts, finding useful network-level predictions through five hours but uneven performance across periods and victim processes.

D. Exploiting LRD to Predict Attack Rates

  • The evaluation fits models on half of each observed network-level series, then compares forecasts with observed attack rates.The prediction horizon is an input measured in hours; the starting point is set to the midpoint to build reliable models.Source: D. Exploiting LRD to Predict Attack… · p. 8
  • For spurious-LRD Period III, both FARIMA and ARMA predict up to five hours ahead, and FARIMA's prediction error is slightly greater.The authors advise against LRD-aware models when a process does not exhibit LRD, and in favor of them when it does.Source: D. Exploiting LRD to Predict Attack… · pp. 8–9
  • For Periods I and II, 1-hour and 5-hour FARIMA prediction errors are no greater than 22%, while 10-hour predictions are poor.The authors say the shorter-horizon results provide enough early-warning time for defenders.Source: D. Exploiting LRD to Predict Attack… · p. 8, Table IX · p. 9
  • Period IV's 1-hour FARIMA error exceeds 50%, but its 5-hour underestimation error is 22.6% for FARIMA and 20.7% for ARMA.The authors consider the result useful if defenders are willing to over-provision resources.Source: D. Exploiting LRD to Predict Attack… · p. 9
  • Period V resists both models on overall and underestimation error; the authors leave the cause unresolved and suggest Extreme Value Theory for future study.Across victim-level processes, 70% exhibit LRD, while neither model predicts non-LRD processes well; the authors suggest non-stationarity may contribute.Source: D. Exploiting LRD to Predict Attack… · p. 9
  • FARIMA predicts at least 70% overall accuracy for 29 Period I victim processes, versus 13 for ARMA; for underestimation accuracy, the counts are 40 and 35.These comparisons cover 152 LRD processes amenable to prediction; seven additional Period I LRD processes could not be predicted because the FARIMA estimator did not converge.Source: D. Exploiting LRD to Predict Attack… · p. 9

E. Exploring (Non)Causes of LRD

The authors examine whether heavy-tailed processes or intense attacks explain LRD, and conclude neither candidate cause is necessary in this dataset.

E. Exploring (Non)Causes of LRD

  • Only Period I had a majority of victim processes with heavy tails: 101 of 166, compared with 0, 24, and 31 in Periods II, IV, and V.This pattern suggests network-level LRD does not share the proposed cause of LRD in benign traffic.Source: E. Exploring (Non)Causes of LRD · p. 9
  • Heavy tails occur in 218 of 2,880 port-level processes, and only 29 of 576 victims have two or three heavy-tailed port processes.The authors conclude that victim-level LRD is not caused by superposition of heavy-tailed port-level processes.Source: E. Exploring (Non)Causes of LRD · pp. 9–10
  • Many attacker-level processes also exhibit LRD, which the authors use to argue that victim-level LRD is not caused by individual attackers' consecutive attacks.In Period I, 153 victims' attacker-level processes suggest LRD without spurious LRD; in Period V, all 166 have average Hurst parameters in [.6, 1], but 89 exhibit spurious LRD.Source: E. Exploring (Non)Causes of LRD · pp. 10–11
  • Observed LRD is not necessarily caused by either heavy-tailed process superposition or intense attacks by individual attackers.The authors rule out these two candidate causes but leave the cause of LRD unresolved.Source: E. Exploring (Non)Causes of LRD · p. 11

V. DISCUSSION

The discussion distinguishes limits imposed by the case-study dataset from the broader descriptive, predictive, and diagnostic uses the authors propose for the framework.

A. Limitation of the Case Study

  • The case study covers only 166 honeypot IP addresses across 220 days, and the authors want larger datasets.They note that researchers can apply the framework to their own larger datasets.Source: A. Limitation of the Case Study · p. 11
  • Because the low-interaction honeypot data is attack-agnostic, it identifies targeted ports and services but not specific attacks.The authors say high-interaction honeypots can resolve this limitation, though they note legal concerns; the framework can analyze such data at finer resolution.Source: A. Limitation of the Case Study · p. 11
  • The case study uses honeypot rather than production-network data, so whether blended production traffic exhibits LRD remains open.The authors identify legal and privacy concerns as challenges to collecting such data.Source: A. Limitation of the Case Study · p. 11

B. Usefulness of the Statistical Framework

  • The framework's descriptive workflow starts with basic statistical properties, then rigorously tests advanced properties suggested by those initial observations.The authors report that this approach led them to identify LRD's relevance in this cyber-security setting.Source: B. Usefulness of the Statistical… · p. 11
  • The framework can exploit identified statistical properties to predict attack rates hours ahead and support proactive resource provisioning.With high-interaction honeypot data, the authors say analyses can target specific attacks and, conditionally, new attacks when exploitable properties are present.Source: B. Usefulness of the Statistical… · p. 11
  • A change in traffic properties, such as new LRD after known attacks are filtered, can hint at new attacks and guide further forensics.The authors say detailed traffic information needed for the forensic examination is not captured by low-interaction honeypots, but can be captured by high-interaction honeypots and production defense systems.Source: B. Usefulness of the Statistical… · pp. 11–12
  • In a production network, randomly scattered honeypot IPs could make honeypot attack rates comparable to production-IP attack rates, supporting hours-ahead forecasting.The authors describe this as an ideal deployment scenario, especially with frequently shuffled, high-interaction honeypots; the reasoning also applies after known attacks are filtered.Source: B. Usefulness of the Statistical… · p. 12

VI. RELATED WORK

The paper distinguishes its rigorous statistical analysis of honeypot data from prior work and reports honeypot-captured attack-rate LRD for the first time. Its conclusion presents a multi-resolution framework, reports LRD-aware attack-rate prediction, and identifies open research problems.

VI. RELATED WORK

  • Prior honeypot studies covered probing, attack grouping, and threat characterization, while defense applications such as detecting DoS and worms were orthogonal to this paper’s focus.The paper also distinguishes its two-way honeypot communications and rigorous statistical analysis from blackhole studies of mainly one-way traffic.Source: §VI · p. 12
  • The authors report LRD in honeypot-captured cyber attack data for the first time, using autocorrelation, Hurst estimates, and nonstationarity analysis.They distinguish this rigorous attack-rate analysis from prior work on benign traffic, injected attacks, and spam inter-arrival times.Source: §VI · p. 12

VII. CONCLUSION AND FUTURE WORK

  • The conclusion frames stochastic cyber attack processes at network, victim, and port resolutions and centers a framework on identifying, exploiting, and exploring their statistical properties.The framework is demonstrated on low-interaction honeypot data.Source: §VII · pp. 12–13
  • Most studied attack processes exhibit LRD, and LRD-aware models predict attack rates up to five hours ahead, especially for network-level processes.The paper says the early-warning time would be sufficient for defenders and that gray-box prediction outperforms black-box prediction.Source: §VII · p. 13
  • Future work includes improving prediction accuracy, explaining LRD’s cause, testing possible scale-invariance, studying adaptive high-interaction honeypots, and using prediction errors.FARIMA may miss extreme attack-rate spikes; the study ruled out only two candidate causes of LRD.Source: §VII · p. 13

APPENDIX A REVIEW OF SOME STATISTICAL TECHNIQUES

The appendix reviews six methods for estimating the Hurst parameter, describing block-based approaches and frequency-based estimators used to assess long-range dependence.

A. Methods for Estimating Hurst Parameters

  • The appendix uses six popular methods for estimating the Hurst parameter.It lists R/S, aggregated variance, Peng, periodogram, boxed periodogram, and wavelet methods.Source: A. Methods for Estimating Hurst… · p. 14
  • The R/S method defines a statistic for a time series and gives its behavior for LRD series.Source: A. Methods for Estimating Hurst… · p. 14
  • The aggregated-variance method divides the series into blocks, then uses the variance of block averages to estimate Var(X(m)).For LRD series, β = 2H − 2, and the variance follows a scaling relation with block size m.Source: A. Methods for Estimating Hurst… · p. 14
  • The Peng method averages residual variances from blockwise partial-sum fits, with the resulting quantity proportional to m^2H for LRD series.Source: A. Methods for Estimating Hurst… · p. 14
  • For the periodogram method, a log-periodogram versus log-frequency regression has coefficient 1 − 2H; boxed-periodogram and wavelet estimators are also reviewed.The boxed method addresses the concentration of H-estimation points on the graph’s right side; the wavelet estimator fits a line to a wavelet-derived spectrum.Source: A. Methods for Estimating Hurst… · p. 14

B. Heavy-tail Distributions

This appendix reviews heavy-tail distributions and the point-over-threshold method, which models observations above a high threshold using a generalized Pareto distribution.

B. Heavy-tail Distributions

  • A distribution is heavy-tailed in this treatment when it belongs to the maximum domain of attraction of an extreme-value distribution.The appendix introduces this domain through a condition involving normalizing constants and the distribution function.Source: B. Heavy-tail Distributions · p. 15
  • The point-over-threshold method selects a high threshold u for independent, identically distributed heavy-tailed observations.Source: B. Heavy-tail Distributions · p. 15
  • Under the point-over-threshold method, exceedances Xi − u conditional on Xi > u follow a generalized Pareto distribution.The appendix also identifies the generalized Pareto survival function and its support conditions.Source: B. Heavy-tail Distributions · p. 15

C. Goodness-of-fit Test Statistics

The appendix defines the empirical distribution function and reviews Kolmogorov–Smirnov, Cramér–von Mises, and Anderson–Darling goodness-of-fit statistics.

C. Goodness-of-fit Test Statistics

Loading 1603.07433v1…