CyberdeceptionAtlas · Question → testES

Library / Paper

Paper

Measuring and Clustering Network Attackers using Medium-Interaction Honeypots

This paper describes the deployment of medium-interaction honeypots across five different protocols on the public Internet to study the intent and sophistication of observed attacks. The authors propose a clustering approach that identifies correlations in attacker behavior to detect IP addresses likely controlled by a single operator, highlighting the usefulness of these honeypots for data collection.

HoneypotNetwork

What we know

This paper describes the deployment of medium-interaction honeypots across five different protocols on the public Internet to study the intent and sophistication of observed attacks. The authors propose a clustering approach that identifies correlations in attacker behavior to detect IP addresses likely controlled by a single operator, highlighting the usefulness of these honeypots for data collection.

Evidence limits

This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the clustering results have not been independently verified.

Reviewed: author abstract. Full-text results were not analyzed.

Sources and provenance

  1. Measuring and Clustering Network Attackers using Medium-Interaction Honeypots
    abstract · 2026-10-04

Reviewed: 2026-10-04. This record may change when new evidence is found.

RIS · BibTeX