Global Honeypot Trends: Analysis of One Year of Live Attack Data
Elliot Brink analyzes over one year of telemetry from a globally distributed honeypot sensor network, tracking automated botnet propagation and brute-force trends.
Summary
Deploying a Global Sensor Network
To observe real-world adversary behavior, Elliot Brink deployed low-interaction and medium-interaction honeypots across multiple cloud providers and geographical regions.
Analyzing 12 Months of Telemetry Data
Brink categorizes millions of connection attempts, mapping brute-force credential dictionaries, automated SSH exploitation scripts, and web scanner traffic.
Identifying Botnet Infrastructure and Geographic Origins
The author tracks infected IoT botnets scanning for open Telnet ports and unpatched embedded routers across major autonomous systems.
Applying Honeypot Intelligence to Enterprise Defense
The presentation outlines how SOC teams can utilize honeypot IP blacklists and behavioral trends to preemptively block adversary scanning.
Related talks
Village Presentations·38 min
Robert Simmons
Robert Simmons explains how to construct high-volume spam honeypots to capture live malware binaries, track bulletproof hosts, and harvest threat intel.
S4 Events·27 min
Engineers explore architecture and security mechanisms for Honeypots For Threat Intelligence.
Main Stage·34 min
Michael Torres · Zane Hoffman
Provides an inside look at a massive operational relay network (ORB) of compromised IoT devices and routers used by Chinese APT actors to obfuscate cyber attacks.