A computer-implemented method for modeling cyber-attack patterns by a honeypot system wherein said honeypot system supports a plurality of protocols, comprising: a. defining a set of attack features; b. obtaining a dataset comprising monitored cyber-attack metadata; c. filtering said dataset to a desired contextual subset of cyber-attacks using a context filter ; d. defining attack sessions from said contextual subset using a session creator ; e. extracting values for each feature, respectively, from each said attack sessions using a feature extractor ; f. generating from said features values attack profiles, each profile relating to a set of attacks; g. clustering the attack profiles based on features of said profiles using a cluster modeler and creating pattern clusters using the cluster modeler ; h. enriching the cluster centroid representation of the patterns observed by the cluster modeler ; using a cluster distribution calculator ; i. outlining important features which distinguish between pattern clusters using a cluster feature selector ; characterized by further comprising: j. calculating a closeness similarity between said pattern clusters using a cluster similarity calculator , the calculating comprising steps k., 1. and m.; k. calculating the similarity between each pattern pair using the Normalized Euclidean Distance between the two relevant cluster centroids; l. calculating the similarity matrix between all possible pairs; m. sorting the patterns according to their similarity, to obtain a data structure which specifies, for each discovered pattern cluster, a list of corresponding pattern clusters from the most similar to the least similar; n. analyzing a portion of the communicated data using a hardware processor of said honeypot system; o. based on steps h., i., and j., generating a model that represents cyber-attack patterns; and p. storing said model in a repository. a. defining a set of attack features; b. obtaining a dataset comprising monitored cyber-attack metadata; c. filtering said dataset to a desired contextual subset of cyber-attacks using a context filter ; d. defining attack sessions from said contextual subset using a session creator ; e. extracting values for each feature, respectively, from each said attack sessions using a feature extractor ; f. generating from said features values attack profiles, each profile relating to a set of attacks; g. clustering the attack profiles based on features of said profiles using a cluster modeler and creating pattern clusters using the cluster modeler ; h. enriching the cluster centroid representation of the patterns observed by the cluster modeler ; using a cluster distribution calculator ; i. outlining important features which distinguish between pattern clusters using a cluster feature selector ; j. calculating a closeness similarity between said pattern clusters using a cluster similarity calculator , the calculating comprising steps k., 1. and m.; k. calculating the similarity between each pattern pair using the Normalized Euclidean Distance between the two relevant cluster centroids; l. calculating the similarity matrix between all possible pairs; m. sorting the patterns according to their similarity, to obtain a data structure which specifies, for each discovered pattern cluster, a list of corresponding pattern clusters from the most similar to the least similar; n. analyzing a portion of the communicated data using a hardware processor of said honeypot system; o. based on steps h., i., and j., generating a model that represents cyber-attack patterns; and p. storing said model in a repository. <EOS>