What we know
The authors study attacker behavior across eleven SSH honeypots accepting both interactive and non-interactive sessions over fifteen days. According to the abstract, they found that the vast majority of authenticated sessions were non-interactive, challenging common assumptions in cyber deception research focused on interactive shells.
Evidence limits
This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the analysis has not been independently replicated.
Reviewed: author abstract. Full-text results were not analyzed.
Sources and provenance
- Ghost Without Shell: Measuring Non-Interactive SSH Attacks on Honeypots
abstract · 2026-10-04
Reviewed: 2026-10-04. This record may change when new evidence is found.