Classification of TCP 445 Attacks and Global Snapshot with Honeypot Analysis

Abstract

This paper analyzes malicious activities collected in port 445 for 20 days by honeypot, by exposing our computer to malicious hosts and luring them to intrude it. We filtered the intrusion packets by Samba protocol and find their characteristics for classifying them into 3 types and processed them for their source IP address. The goal is obtaining the source country corresponding to each type of malicious activities in port 445 so that we could analyze their source country distribution.