Cowrie Honeypot Data Analysis and Predicting the Directory Traverser Pattern during the Attack

Abstract

Honeypots are recent innovation in intrusion detection technology. They are the traps designed to basically entrap potential intruders and log their activities. The main objective of such systems is to collect the information about the intruders, deviate them from accessing critical systems, push them to stay on top of the system for some time so their behavior can be observed. We have used Cowrie Honeypot to achieve the above objectives. The log of intruder activities is maintained which is processed and graphically visualized using ELK. This intruder activity data is useful to know the intruder behavior and accordingly safety measures can be employed against that. In extension to data visualization, we have also implemented the probabilistic approach to predict the directory traverser pattern of the intruder. This will help us to understand the next traverser step in advance so that we can take precautionary measures to avoid it.