What we know
The authors propose applying natural language processing techniques to shell commands captured via honeypots to detect and correlate botnet behaviors. The approach reduces command sequences to stochastic processes, then processed with machine learning to build classifiers and predictors that cluster botnet source IP addresses, even when attackers attempt to obfuscate intrusion attempts through rapid or random permutation techniques.
Evidence limits
This entry is based solely on the publicly available title and abstract; the full text has not been read, and the technique's effectiveness has not been independently verified or replicated.
Reviewed: author abstract. Full-text results were not analyzed.
Sources and provenance
- Identifying botnet IP address clusters using natural language processing techniques on honeypot command logs
abstract · 2026-10-04
Reviewed: 2026-10-04. This record may change when new evidence is found.