CyberdeceptionAtlas · Question → testES

Library / Paper

Paper

Nested Dirichlet models for unsupervised attack pattern detection in honeypot data

The article explores Dirichlet distribution topic models for clustering terminal session commands collected from honeypots, aiming to find groups of attacks sharing a common intent and to identify outliers. The authors introduce primary and secondary topics, and session-level and command-level topics, and extend the methods in a Bayesian nonparametric fashion to allow unbounded vocabulary size and number of latent intents.

HoneypotNetwork

What we know

The article explores Dirichlet distribution topic models for clustering terminal session commands collected from honeypots, aiming to find groups of attacks sharing a common intent and to identify outliers. The authors introduce primary and secondary topics, and session-level and command-level topics, and extend the methods in a Bayesian nonparametric fashion to allow unbounded vocabulary size and number of latent intents.

Evidence limits

Review based only on the Crossref-deposited abstract; the full text was not read and results were not independently validated.

Reviewed: author abstract. Full-text results were not analyzed.

Sources and provenance

  1. Nested Dirichlet models for unsupervised attack pattern detection in honeypot data
    abstract · 2026-10-11

Reviewed: 2026-10-16. This record may change when new evidence is found.

RIS · BibTeX