# A Novel Approach Towards Analysis of Attacker Behavior in DDoS Attacks

Himanshu Gupta, Tanmay Girish Kulkarni, Lov Kumar, Neti Murthy

► To cite this version:

Himanshu Gupta, Tanmay Girish Kulkarni, Lov Kumar, Neti Murthy. A Novel Approach Towards Analysis of Attacker Behavior in DDoS Attacks. 2nd International Conference on Machine Learning for Networking (MLN), Dec 2019, Paris, France. pp.392-402, 10.1007/978-3-030-45778-5_27. hal-03266457

HAL Id: hal-03266457

https://inria.hal.science/hal-03266457

Submitted on 21 Jun 2021

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# A Novel Approach towards Analysis of Attacker Behavior in DDoS Attacks

Himanshu Gupta, Tanmay G. Kulkarni, Lov Kumar and N.L. Bhanu Murthy

BITS Pilani, Hyderabad Campus, Hyderabad, India
{f20150339,f20150647,lovkumar,bhanu}@hyderabad.bits-pilani.ac.in

**Abstract.** Traditionally, research in Network Security has largely focused on Intrusion Detection and the use of Machine Learning techniques towards identifying malicious agents as well as work on methods towards protecting ourselves from such attacks. In this paper, we wish to make use of the same techniques to analyze the profile of the attacker in the case of a DDoS attack on a distributed honeypot.

**Keywords:** Distributed Denial of Service Attacks · Honey Pot · Machine Learning · Clustering Algorithms · Attacker Profiling.

## 1 Introduction

The username password combination is one of the primary methods of authentication in most of the organizations portals. Many methods such as the man in the middle attack[3], DNS spoofing [6], and phishing attacks[16] are used to obtain username password combinations. All of these activities are examples of penetration attacks as they allow an attacker to intercept the connection and make them believe that they are on the right website.[1] In the aforementioned approaches, the user is fooled into giving their access credentials. Here, we analyze another type of attack, known as a brute force attack. In this approach, the attacker attempts to guess the username and password with the help of tools that make use of dictionaries of a username and password combinations. This approach leads to an increase in load on the server, which in turn blocks the actual user from logging in, this is an example of a denial of service attack. In the scenario in which, such an attack is distributed, it is an example of a distributed denial of service attack. [7, 5, 13]

In this paper, we make use of Kippo honeypot[4, 10], which helps us log brute force attacks and help us understand the behavior patterns of the hacker. The hacker attempts to gain access with the help of a Secure Shell session. Here, we have made use of the data obtained from a honey pot deployed within the Information Security Lab of BITS Pilani, Hyderabad Campus.[14, 17]

The primary reason for targeting SSH sessions is due to the fact that a significant number of servers are not well maintained and often make use of weak credentials which make a perfect target for malicious agents.[12] A preliminary analysis of credentials and passwords on SSH remote login servers from secure-honey.net gave the following results:
<table><caption>**Table 1.** Most common SSH Usernames and Passwords.</caption><thead><tr><td>Username</td><td>Frequency</td><td>Password</td><td>Frequency</td></tr></thead><tbody><tr><td>root</td><td>89%</td><td>123456</td><td>41%</td></tr><tr><td>test</td><td>6%</td><td>admin</td><td>19%</td></tr><tr><td>user</td><td>2%</td><td>password</td><td>11%</td></tr><tr><td>admin</td><td>2%</td><td>root</td><td>15%</td></tr></tbody></table>

The primary motive of our research is to find out how data with respect to login credentials propagates[15], once a hacker has been successful in obtaining access to an SSH server. Fig.1 shows how successful attacks on the honey tend to be clustered around certain locations.[9]

<figure><img src="image_2.png" /><figcaption>**Fig. 1.** From the above heatmap, we can see that most of the successful attacks seem to be stemming from North America, Europe, and Southeast Asia.</figcaption></figure>

We also have an image that shows us a zoomed-in perspective in China, from which the majority of the attacks had originally originated. As we can see from the image it appears as if all the attacks appear in pockets, which lends some preliminary support to the hypothesis that data of the credentials appears to spread in the vicinity of the original successful attempt. In the remainder of the paper, we make use of a variety of clustering methods to catch patterns that may escape the human eye.

## 2 Related Work

Babak Nabiyev in his work on the application of Clustering Techniques for the detection of DDoS attacks had made use of the KDD CUP 99 dataset which had been developed by DARPA. He attempted to differentiate between Normal
<figure><img src="image_3.png" /><figcaption>Fig. 2. Distribution of Login Attempts from China.</figcaption></figure>

Traffic and DDoS traffic with the help of K-Means and EM Clustering techniques. He had clubbed together six cases of DoS attacks as a single type and he defined normal traffic flow to be the other type of behavior. Consequently, he made use of these two classes for the final clustering analysis.[8]

Shi Zhong also had made use of different clustering techniques for intrusion detection. In addition, he had also made use of the DARPA intrusion detection project for his dataset. Furthermore, he had done a comparative study on different clustering algorithms for intrusion detection, in which he concluded that unsupervised clustering algorithms performed better than supervised learning methods. Out of all the clustering algorithms, his proposed self-labeling heuristic performed the best with an overall accuracy of 93.6 %. [19]

Nikolskaia Kseniia analyzed IP traffic with the help of clustering on IP packet headers. He considered multiple parameters such as the classification parameters based on packet and transmission properties, choice of clustering methods and the number of clusters. He concluded that real-time data is too complex to dynamically change features or clustering algorithms. A hybrid neural network approach showed the best results with about 95% correctness. [11]

Jie Wang argues that clustering algorithms may not work very properly for intrusion detection because the similarity level of data points cannot be controlled. He proposes a two seed expanding algorithm that splits the attacks into different phases. The preprocessing includes creating a network flow and changing continuous-valued features to binary features. Based on these features, the algorithm selects seeds until all flows are divided into clusters. Their experiments show that two seed expanding algorithm performs better than the k -means and other clustering methods. [18]
Geoff Boeing used k-means clustering and dbscan techniques to cluster 1759 points of latitude and longitude data and they were reduced to 138 points and obtained 92% compression, without losing out on the key features of the information that had been spatially represented within the dataset.[2]

# 3 Research Framework

**Experimental Setup** We have deployed honey pots with the distributed architecture as shown in Fig. 3

<figure><img src="image_4.png" /><figcaption>Fig. 3. The Honey Pot Architecture which was used For the D-DoS Attack.</figcaption></figure>

The hypervisor runs five virtual machines, each of which runs a mini-Ubuntu 16.04. Each instance, in turn, runs a different honeypot. The traffic to the virtual machines is controlled with the help of a firewall and Network Address Translation (NAT) to assist us to communicate with the outside world. The server runs
within the Information Security Laboratory of BITS, Pilani-Hyderabad campus network. The server continuously monitors the activity that occurs on the public IP addresses.

<table><caption>**Table 2.** Spec table of the Honeypot used — Kippo.</caption><thead><tr><td>Components</td><td>Specs</td></tr></thead><tbody><tr><td>Processor</td><td>Intel Xeon</td></tr><tr><td>RAM</td><td>8GB</td></tr><tr><td>Hard Disk</td><td>400 GB</td></tr><tr><td>Operating System</td><td>Ubuntu 16.04</td></tr></tbody></table>

# 4 Analysis

## 4.1 Attackers origin

The origin of the attacker refers to the country or the city location from which the attack is being initiated. The source of their IP address help determines the location of the attacker. We made use of the urllib2 library to find the location of the attackers. However, IP addresses do not prove to be useful if the attacker makes use of a VPN or Tor Network. The results of the analysis have been mentioned in Table 3:

<table><caption>**Table 3.** Successful attempts city and country wise.</caption><thead><tr><td>City</td><td>Attempts</td><td>Country</td><td>Attempts</td></tr></thead><tbody><tr><td>Ho Chi Minh</td><td>3225</td><td>Vietnam</td><td>3586</td></tr><tr><td>Kansas City</td><td>1237</td><td>United States</td><td>1368</td></tr><tr><td>Radomsko</td><td>521</td><td>Poland</td><td>522</td></tr><tr><td>Saint Petersburg</td><td>306</td><td>Russia</td><td>354</td></tr><tr><td>Prague</td><td>251</td><td>Netherlands</td><td>326</td></tr><tr><td>Hanoi</td><td>193</td><td>China</td><td>323</td></tr></tbody></table>

We observe that there seem to be clusters of activity followed by patches of inactivity as seen in fig 4. Here, we observe there as spikes of activity in the second week and the last week of June as well as the second week of July as well as the end of October and the beginning of November. On the other hand, there seem to be very less attacks initiated in the months of August and September and hence they were not accommodated in the graph.

## 4.2 Traffic Analysis

We had segmented the data into files of 1MB size and had a total of 250MB data. The configuration had allowed at most 21 attempts from a particular IP before the IP was banned. Total 870 usernames and 9027 unique passwords were attempted.
<figure><img src="image_5.png" /><figcaption>Fig. 4. Attempts Distribution over 6 months</figcaption></figure>

<table><caption>**Table 4.** Most popular Passwords and **Table 5.** Most popular Passwords and Number of Attempts</caption><thead><tr><th>Username</th><th>Counts</th><th>Username</th><th>Counts</th></tr></thead><tbody><tr><td>root</td><td>190791</td><td>1234</td><td>1033</td></tr><tr><td>admin</td><td>27161</td><td>guest</td><td>838</td></tr><tr><td>ubnt</td><td>4056</td><td>test</td><td>816</td></tr><tr><td>support</td><td>3597</td><td>usuario</td><td>740</td></tr><tr><td>user</td><td>2533</td><td>pi</td><td>730</td></tr></tbody></table>

<table><thead><tr><th>Password</th><th>Attempts</th><th>Password</th><th>Attempts</th></tr></thead><tbody><tr><td>admin</td><td>13802</td><td>12345</td><td>2285</td></tr><tr><td>ubnt</td><td>4653</td><td>123456</td><td>2146</td></tr><tr><td>1234</td><td>4508</td><td>user</td><td>1962</td></tr><tr><td>support</td><td>3179</td><td>default</td><td>1690</td></tr><tr><td>password</td><td>2707</td><td>admin123</td><td>1341</td></tr></tbody></table>

The most attempted username was "root" and the most attempted password was "admin". In addition to the popular combination of 'root' and 'admin' we also get to see that the attackers tried other popular default passwords such as ubnt (as we made use of the Ubuntu operating system) as well as 1234, support and password. Furthermore, the hackers had also made use of popular user-names such as admin, user and guest. This analysis shows something as simple as setting a strong username password combination can reduce the number of successful breaches in security. Finally, we observe that an overwhelming majority of attacks on the distributed honeypot system appear to be coming from China.

## 4.3 Machine Learning Analysis

On this data, we have made use of three clustering methods which has helped us gain insight on the attacker's profile after obtaining access to the system. Here,
<table><caption>**Table 6.** Two Day of Interactions for the Ho Chi Minh City, Vietnam on 26th June and 27th June, 2018 — Obtained by 2 gram Clustering Approach</caption><thead><tr><td>IP</td><td>Attempts</td><td>City</td><td>Country</td></tr></thead><tbody><tr><td>116.31.116.20</td><td>20350</td><td>Guangzhou</td><td>China</td></tr><tr><td>58.218.198.147</td><td>18817</td><td>Nanjing</td><td>China</td></tr><tr><td>58.218.198.153</td><td>7478</td><td>Nanjing</td><td>China</td></tr><tr><td>103.207.36.213</td><td>4545</td><td>Ho Chi Minh</td><td>Vietnam</td></tr><tr><td>58.218.198.167</td><td>2590</td><td>Jiangsu</td><td>China</td></tr><tr><td>91.211.1.100</td><td>2161</td><td>Vabalninkas</td><td>Lithuania</td></tr><tr><td>58.218.198.170</td><td>1969</td><td>Nanjing</td><td>China</td></tr><tr><td>31.207.47.50</td><td>1653</td><td>Amsterdam</td><td>Netherlands</td></tr><tr><td>116.31.116.21</td><td>1640</td><td>Guangzhou</td><td>China</td></tr><tr><td>58.218.198.172</td><td>1542</td><td>Nanjing</td><td>China</td></tr></tbody></table>

we have pooled the data in a manner that is similar to that used within n-gram models of Natural language processing. Thus, the data comes in three forms-

- Single day data

- Two days at a time

- Three days at a time

We have made use of 3 different clustering algorithms namely mean shift clustering, GMM Clustering and Kmeans clustering to gain a better insight on the information presented through the data. From the figures 5,6 and 7 we observe that most of the attacks seem to be concentrated only in certain parts of the world. This means that the information gained by the attacker seems to be spreading only to the vicinity to the earliest attack, rather than spreading randomly over the world.

<figure><img src="image_6.png" /><figcaption>**Fig. 5.** Mean Shift Clustering (a) 1 gram (b) 2 gram (c) 3 gram</figcaption></figure>

All three techniques seem to give us the **similar results**-

- All techniques give cluster centers which are very close to one another.

- The cluster centers obtained are similar across 1 gram, 2 gram and 3 gram

On the other hand there seem to be some **key differences**-
<figure><img src="image_7.png" /><figcaption>Fig. 6. GMM Clustering (a) 1 gram (b) 2 gram (c) 3 gram</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 7. Kmeans Clustering (a) 1 gram (b) 2 gram (c) 3 gram</figcaption></figure>

- The mean shift algorithm appears to be more susceptible to outliers, which causes it to detect a greater number of clusters.

- On the other hand, the algorithm behaves better when we increase the number of data points as in the case of 2 gram and 3 gram.

To better understand why the clustering algorithms have singled out these locations, we have probed the data from 1 gram, 2 gram and 3 gram on specific geographic locations so as to search for patterns that could help us better understand how the attack seems to propagate.

<table><caption>Table 7. One Day of Interaction for the Date 27th October, 2018 from China on - Obtained from the 1 gram clustering approach</caption><thead><tr><th>Time</th><th>IP</th><th>CIty</th><th>Country</th><th>Time</th><th>IP</th><th>CIty</th><th>Country</th></tr></thead><tbody><tr><td>13:45:41+0530</td><td>60.182.212.131</td><td>Jinhua</td><td>China</td><td>13:58:45+0530</td><td>112.236.177.74</td><td>Qingdao</td><td>China</td></tr><tr><td>13:46:03+0530</td><td>60.255.146.181</td><td>Chengdu</td><td>China</td><td>14:04:46+0530</td><td>125.92.182.50</td><td>Shiqi</td><td>China</td></tr><tr><td>13:46:11+0530</td><td>110.184.170.247</td><td>Zhongba</td><td>China</td><td>14:05:30+0530</td><td>121.14.7.244</td><td>Guangzhou</td><td>China</td></tr><tr><td>13:49:10+0530</td><td>182.44.84.228</td><td>Jinan</td><td>China</td><td>14:06:51+0530</td><td>110.249.217.82</td><td>Xingfeng</td><td>China</td></tr><tr><td>13:52:27+0530</td><td>210.51.191.26</td><td>Beijing</td><td>China</td><td>14:07:03+0530</td><td>58.218.198.147</td><td>Nanjing</td><td>China</td></tr><tr><td>13:52:53+0530</td><td>58.48.178.200</td><td>Shuiguo</td><td>China</td><td>14:07:52+0530</td><td>218.60.136.106</td><td>Chaoyang</td><td>China</td></tr><tr><td>13:54:21+0530</td><td>60.185.214.42</td><td>Zhoushan</td><td>China</td><td>14:08:52+0530</td><td>111.121.192.6</td><td>Guiyang</td><td>China</td></tr><tr><td>13:54:49+0530</td><td>222.47.26.139</td><td>Hangzhou</td><td>China</td><td>14:10:41+0530</td><td>153.34.109.60</td><td>Chaowai</td><td>China</td></tr><tr><td>13:55:29+0530</td><td>124.243.216.102</td><td>Beijing</td><td>China</td><td>14:14:27+0530</td><td>122.190.252.82</td><td>Xiangfan</td><td>China</td></tr><tr><td>13:58:08+0530</td><td>218.108.124.26</td><td>Hangzhou</td><td>China</td><td>14:15:32+0530</td><td>113.122.34.247</td><td>Jinan</td><td>China</td></tr><tr><td>13:58:11+0530</td><td>113.122.5.6</td><td>Jinan</td><td>China</td><td>14:19:16+0530</td><td>113.206.115.125</td><td>Beiwenquan</td><td>China</td></tr><tr><td>13:58:11+0530</td><td>210.51.191.26</td><td>Beijing</td><td>China</td><td>14:23:03+0530</td><td>123.149.128.181</td><td>Henan</td><td>China</td></tr></tbody></table>
In the 1 gram analysis for table 7, we observe that all the successful attacks have appeared to have taken place one after another after short intervals of time. In addition, we can see that once an attacker gains access, it seems like the others in the vicinity gain access after a short interval of time.

In Table 8, we observe the following observation. The set of IP addresses that make a successful attempt on the first day are the same as those which are obtained on the following day. However, we notice that now there is a new IP from the same location that is now able to successfully gain access to the honeypot. This means either the attacker has gained access to a new IP or another attacker has received information about the same from another attacker in the same geolocation.

<table><caption>**Table 8.** Two Day of Interactions for the Ho Chi Minh City, Vietnam on 26th June and 27th June, 2018 — Obtained by 2 gram Clustering Approach</caption><thead><tr><th>Date</th><th>IP</th><th>Count</th><th>Date</th><th>IP</th><th>Count</th></tr></thead><tbody><tr><td>2018-06-26</td><td>142.54.189.114</td><td>90</td><td>2018-06-27</td><td>142.54.189.114</td><td>104</td></tr><tr><td>2018-06-26</td><td>173.208.187.66</td><td>2</td><td>2018-06-27</td><td>192.187.103.2</td><td>223</td></tr><tr><td>2018-06-26</td><td>192.187.103.2</td><td>204</td><td>2018-06-27</td><td>192.69.95.132</td><td>4</td></tr><tr><td>2018-06-26</td><td>69.197.135.10</td><td>23</td><td>2018-06-27</td><td>69.197.135.10</td><td>15</td></tr></tbody></table>

<table><caption>**Table 9.** 3 Days of Interactions for the country of Vietnam from 6th June to 8th June 2018 — Obtained by 3 gram Clustering Approach</caption><thead><tr><th>Date</th><th>IP</th><th>Count</th><th>Date</th><th>IP</th><th>Count</th><th>Date</th><th>IP</th><th>Count</th></tr></thead><tbody><tr><td>2018-06-06</td><td>103.207.36.117</td><td>1</td><td>2018-06-06</td><td>116.98.0.212</td><td>1</td><td>2018-06-07</td><td>116.103.77.175</td><td>2</td></tr><tr><td>2018-06-06</td><td>103.207.36.9</td><td>2</td><td>2018-06-06</td><td>117.3.47.59</td><td>2</td><td>2018-06-07</td><td>116.105.225.86</td><td>2</td></tr><tr><td>2018-06-06</td><td>103.207.37.239</td><td>4</td><td>2018-06-06</td><td>117.5.195.121</td><td>1</td><td>2018-06-07</td><td>117.3.47.59</td><td>1</td></tr><tr><td>2018-06-06</td><td>103.207.39.43</td><td>3</td><td>2018-06-06</td><td>123.16.32.196</td><td>3</td><td>2018-06-07</td><td>125.212.226.227</td><td>1</td></tr><tr><td>2018-06-06</td><td>103.207.39.54</td><td>1</td><td>2018-06-06</td><td>123.19.170.93</td><td>1</td><td>2018-06-07</td><td>14.176.232.175</td><td>5</td></tr><tr><td>2018-06-06</td><td>103.79.141.153</td><td>2</td><td>2018-06-06</td><td>14.167.67.203</td><td>1</td><td>2018-06-07</td><td>27.70.150.55</td><td>1</td></tr><tr><td>2018-06-06</td><td>103.79.141.39</td><td>1</td><td>2018-06-06</td><td>14.176.232.175</td><td>3</td><td>2018-06-07</td><td>58.186.98.43</td><td>1</td></tr><tr><td>2018-06-06</td><td>103.79.143.136</td><td>6</td><td>2018-06-06</td><td>27.78.21.103</td><td>2</td><td>2018-06-08</td><td>103.207.39.159</td><td>2</td></tr><tr><td>2018-06-06</td><td>103.89.88.11</td><td>9</td><td>2018-06-06</td><td>42.118.152.107</td><td>1</td><td>2018-06-08</td><td>103.79.141.153</td><td>1</td></tr><tr><td>2018-06-06</td><td>113.170.210.40</td><td>1</td><td>2018-06-07</td><td>103.207.37.239</td><td>4</td><td>2018-06-08</td><td>103.89.88.11</td><td>9</td></tr><tr><td>2018-06-06</td><td>113.22.152.202</td><td>2</td><td>2018-06-07</td><td>103.207.39.228</td><td>1</td><td>2018-06-08</td><td>116.103.147.230</td><td>6</td></tr><tr><td>2018-06-06</td><td>116.104.79.5</td><td>1</td><td>2018-06-07</td><td>103.207.39.43</td><td>2</td><td>2018-06-08</td><td>116.98.44.241</td><td>1</td></tr><tr><td>2018-06-06</td><td>116.105.225.86</td><td>4</td><td>2018-06-07</td><td>103.79.141.153</td><td>2</td><td>2018-06-08</td><td>14.176.232.175</td><td>4</td></tr><tr><td>2018-06-06</td><td>116.110.160.11</td><td>2</td><td>2018-06-07</td><td>103.79.143.136</td><td>4</td><td>2018-06-08</td><td>27.70.151.209</td><td>2</td></tr><tr><td>2018-06-06</td><td>116.97.24.95</td><td>1</td><td>2018-06-07</td><td>103.89.88.11</td><td>9</td><td>2018-06-08</td><td>27.78.21.103</td><td>2</td></tr></tbody></table>

In Table 9, the pattern in the data obtained from the 3 gram analysis further strengthens the observations that we had made in the case of 2 gram. Here, we can clearly observe that the same set of IP addresses make attack in regular intervals of time. In addition, to those we see additional IP addresses which orig-
inate from the same or nearby locations which gives weight to the argument that
the information about the credentials is spreading to the geographical vicinity.

5 Conclusion

We would like to draw the conclusion that attacks appear to be concentrated in
certain regions. Furthermore, it appears as if the data with respect to the access
credentials does not seem to spread randomly rather, it appears as if the success
with respect to successful attacks seems to spread in the near vicinity of the first
attack.

References

1. Bacudio, A., Yuan, X., Chu, B., Jones, M.: An overview of penetration testing. International Journal of Network Security Its Applications **3**, 19–38 (11 2011). https://doi.org/10.5121/ijnsa.2011.3602

2. Boeing, G.: Clustering to reduce spatial data set size. arXiv preprint arXiv:1803.08101 (2018)

3. Callegati, F., Cerroni, W., Ramilli, M.: Man-in-the-middle attack to the https protocol. IEEE Security & Privacy **7**(1), 78–81 (2009)

4. Doubleday, H., Maglaras, L., Janicke, H.: Ssh honeypot: Building, deploying and analysis. International Journal of Advanced Computer Science and Applications **7** (05 2016). https://doi.org/10.14569/IJACSA.2016.070518

5. Feinstein, L., Schnackenberg, D., Balupari, R., Kindred, D.: Statistical approaches to ddos attack detection and response. In: Proceedings DARPA information survivability conference and exposition. vol. 1, pp. 303–314. IEEE (2003)

6. Klein, A., Golan, Z.: System and method for detecting and mitigating dns spoofing trojans (Sep 11 2012), uS Patent 8,266,295

7. Mirkovic, J., Reiher, P.: A taxonomy of ddos attack and ddos defense mechanisms. ACM SIGCOMM Computer Communication Review **34**(2), 39–53 (2004)

8. Nabiyev, B.: Application of clustering methods network traffic for detecting ddos attacks. Problems of Information Technology **09**, 98–107 (01 2018). https://doi.org/10.25045/jpit.v09.i1.11

9. Najafabadi, M.M., Khoshgoftaar, T.M., Kemp, C., Seliya, N., Zuech, R.: Machine learning for detecting brute force attacks at the network level. In: 2014 IEEE International Conference on Bioinformatics and Bioengineering. pp. 379–385. IEEE (2014)

10. Nawrocki, M., Wählisch, M., Schmidt, T.C., Keil, C., Schönfelder, J.: A survey on honeypot software and data analysis. arXiv preprint arXiv:1608.06249 (2016)

11. Nikolskaia, K.: Network attacks detection based on cluster analysis (10 2017)

12. Owens, J., Matthews, J.: A study of passwords and methods used in brute-force ssh attacks (2008)

13. Schuba, C.L., Krsul, I.V., Kuhn, M.G., Spafford, E.H., Sundaram, A., Zamboni, D.: Analysis of a denial of service attack on tcp. In: Proceedings. 1997 IEEE Symposium on Security and Privacy (Cat. No. 97CB36097). pp. 208–223. IEEE (1997)

14. Sochor, T., Zuzcak, M.: Study of internet threats and attack methods using honeypots and honeynets. In: International Conference on Computer Networks. pp. 118–127. Springer (2014)
15. Tatli, E.: Cracking more password hashes with patterns. IEEE Transactions on Information Forensics and Security **10**, 1-1 (08 2015). https://doi.org/10.1109/TIFS.2015.2422259

16. Thomas, K., Li, F., Zand, A., Barrett, J., Ranieri, J., Invernizzi, L., Markov, Y., Comanescu, O., Eranti, V., Moscicki, A., Margolis, D., Paxson, V., Bursztein, E. (eds.): Data breaches, phishing, or malware? Understanding the risks of stolen credentials (2017)

17. Valli, C., Rabadia, P., Woodward, A.: Patterns and patter-an investigation into ssh activity using kippo honeypots (2013)

18. Wang, J., Yang, L., Wu, J., Abawajy, J.H.: Clustering analysis for malicious network traffic. In: 2017 IEEE International Conference on Communications (ICC). pp. 1-6. IEEE (2017)

19. Zhong, S., Khoshgoftaar, T.M., Seliya, N.: Clustering-based network intrusion detection. International Journal of reliability, Quality and safety Engineering **14**(02), 169-187 (2007)