## 4 Experimental Results
### Results and Analysis of Threat Intelligence Data
Popular usernames like \"admin\" or \"root\", dictionary terms, predictable patterns like \"password\" or \"123456\", default usernames and passwords supplied by manufacturers or administrators, and popular passwords are among the credentials that are commonly used. The results show that default usernames and passwords provided by device makers and/or solution providers were used in the majority of username and password attempts (e.g., root is the username for UNIX-based operating systems). \begin{table}
\begin{tabular}{c c c} \hline
**Honeypot** & **Number of Attacks** & **Percentage (\%)** \\ \hline Ddospot & 264,953 & 36.20 \\ \hline Tanner & 251,673 & 26.37 \\ \hline Honeytrap & 168,853 & 23.98 \\ \hline Heralding & 51,110 & 6.48 \\ \hline Cowrie & 20,905 & 2.65 \\ \hline Dionaea & 18,049 & 2.49 \\ \hline Adbhoney & 5610 & 0.96 \\ \hline Redishoneypot & 2310 & 0.33 \\ \hline Mailoney & 2252 & 0.32 \\ \hline Citrix Honeypot & 1631 & 0.23 \\ \hline \end{tabular}
\end{table} 
Table 6: Total amount of attacks received by each honeypot. \begin{table}
\begin{tabular}{c c c c} \hline
**AS Number** & **Entity Who Owns ASN** & \
\begin{tabular}{c} **Number of** \\ **Attacks** \\ \end{tabular} &
\begin{tabular}{c} **Percentage** \\ **(\%)** \\ \end{tabular} \\ \hline
14061 & DigitalOcean, LLC & 261,732 & 54.26 \\ \hline
53667 & FranTech Solutions & 51,010 & 10.76 \\ \hline
62068 & SpectralP B.V. & 19,829 & 3.88 \\ \hline
37963 & Hangzhou Alibaba Advertising Co., Ltd. & 11,232 & 3.17 \\ \hline
135377 & UCloud (HK) Holdings Group Limited & 9782 & 2.09 \\ \hline
4134 & No. 31, Jin-rong Street & 7989 & 1.84 \\ \hline
52423 & Data Miners S.A. (Racknation.cr) & 5780 & 1.22 \\ \hline
202425 & IP Volume Inc. & 4987 & 0.82 \\ \hline
18403 &
\begin{tabular}{c} The Corporation for Financing and \\ Promoting Technology \\ \end{tabular} & 4801 & 0.45 \\ \hline
14618 & Amazon.com, Inc. & 3940 & 0.44 \\ \hline \end{tabular}
\end{table} 
Table 7: Breakdown of cyber-attacks based on the ASN. The number of attacks received by the destination port is shown in Table 10. Attackers clearly target particular ports, such as port 80 (HTTP), 123 (NTP), 53 (DNS), 5900 (VNC), and 445 (SMB), for a variety of reasons, based on the attacks that have been seen. While NTP amplification attacks have been known to employ port 123, web server vulnerabilities and phishing are known to use port 80. However, port 5900 is utilized for remote desktop access, whereas port 53 is used for DNS amplification and hijacking. Known for its ability to attack SMB, port 445 was notoriously leveraged by the WannaCry ransomware. Attackers are drawn to these ports because of their frequency and related security flaws. Table 11 shows the distributions of operating systems (OS) utilized by attackers as well as the number of attacks based on the usage of \"P0f\", a passive operating system fingerprinting tool that uses passive network traffic analysis to identify the operating \begin{table}
\begin{tabular}{c c c} \hline \hline
**Destination Port** & **Number of Attacks** & **Percentage (\%)** \\ \hline
80 & 351,747 & 54.94 \\ \hline
123 & 138,544 & 21.65 \\ \hline
53 & 127,623 & 19.94 \\ \hline
5900 & 71,103 & 11.11 \\ \hline
445 & 14,062 & 2.20 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Total number of attacks received by the destination port. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Known Attacker Type** & **Number of Attacks** & **Percentage (\%)** \\ \hline known attacker & 76,345 & 84.43 \\ \hline mass scanner & 13,543 & 14.97 \\ \hline bot, crawler & 534 & 0.59 \\ \hline form spammer & 124 & 0.14 \\ \hline anonymizer & 76 & 0.08 \\ \hline tor exit node & 65 & 0.07 \\ \hline compromised & 45 & 0.05 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Breakdown of attacks based on the attacker source IP reputation.