Building a Network Intrusion Model Based on Data from Honeypots
Year: 2018

This paper presents the results of data analysis from a geographically distributed network of honeypots. Such honeypot servers were deployed in Samara, Rostov on Don, Crimea and the USA almost two years ago. The collected data allows for the building of a model of network intrusion. This model includes black lists regarding attacking IP addresses for various Internet services and all kinds of statistics, including calls to OS ports. It is especially necessary to allocate the ranked lists of basi