## 4 Experimental Results
### Results and Analysis of Threat Intelligence Data  
The T-Pot was purposefully intended to entice and deceive cyber attackers by displaying a network of open ports that appear to be running susceptible applications [32,33]. Cyber attackers generally attempt to obtain access to systems via open ports by exploiting flaws or using brute-force approaches. The honeypot server was carefully configured to detect and log these attempts. Throughout the monitoring period, almost 700,000 attacks were logged, all aimed at abusing the built smart health ecosystem. This section gives information on the nature of the detected attacks on the proposed smart health ecosystem. Table 5 shows attacks observed by country of origin (only the top 10 results are highlighted). According to the findings, the bulk of attacks came from China, the United States, and Russia, which may be linked to a variety of factors including larger populations, advanced technical infrastructures, and suspicions of state-sponsored cyber activity. Figure 5: Dashboard generated with Elastic Stack. The breakdown of attacks by nation is shown in Figure 6, where a pie chart makes it evident that China, the US, and Russia accounted for three-fourths of the total attacks. The amount of attacks that each honeypot used in T-Pot received is shown in Table 6 (only the top 10 results are indicated). As a result of Ddospot, Tanner, and Honeytrap simulating weak TCP and UDP services to draw in attackers, the majority of attackers appear to be attempting to take advantage of these services, according to the data. Based on Autonomous System Numbers (ASNs) belonging to global cloud/telecom service providers, Table 7 displays the attacks that have been observed. According to the research's findings, cyberattacks often seem to originate from ASNs as they are associated with businesses, data centers, and Internet service providers [11; 27]. Attackers use these service providers to take advantage of security holes, use compromised resources in ASNs to launch widespread cyber-attacks, and use Virtual Private Networks (VPNs) and proxies to hide their true locations. Hence, by using ASNs, hosting companies may inadvertently serve malicious content that gives the appearance that cyberattacks are emanating from these establishments, enabling attackers to hide their genuine identities [11; 27; 32]. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Country** & **Number of Attacks** & **Percentage (\%)** \\ \hline China & 275,967 & 39.18 \\ \hline United States & 213,421 & 30.30 \\ \hline Russia & 53,876 & 7.65 \\ \hline Netherlands & 52,431 & 7.40 \\ \hline France & 45,671 & 6.48 \\ \hline Brazil & 25,436 & 3.61 \\ \hline Vietnam & 15,634 & 2.22 \\ \hline Canada & 8756 & 1.24 \\ \hline Singapore & 7567 & 1.07 \\ \hline Hong Kong & 5435 & 0.77 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Total no of attacks based on the country of origin. Figure 6: Breakdown of attacks by the country of origin. Based on the reputation of the attacker's originating IP, Table 8 shows the total number of attacks received. Attacker source IP reputation, in general, is the evaluation of the reliability or degree of danger connected to an IP address that is the origin of hostile actions or cyberattacks. It entails assessing an IP address's past behavior and activities to ascertain whether it has participated in criminal activities, such as initiating cyberattacks, disseminating malware, or carrying out fraudulent transactions. Based on the data, it is clear that some of the cyber-attacks were already known because of their originating IP address, even though most attacks came from unknown sources. The top 10 usernames and passwords that attackers have tried to obtain using brute force attacks are listed in Table 9. Brute force attackers utilize a variety of identities and passwords to gain unauthorized access to systems.