From raw honeypot logs to campaign-level intelligence: A framework for bot detection and attacker profiling

Abstract

Modern cyber attacks are increasingly automated and occur at a large scale, which makes them difficult to analyze by using traditional methods. Although honeypots can collect detailed data about attacker activity, this data is often noisy, repetitive, and hard to interpret. As a result, security analysts need approaches that focus on understanding attacker behavior rather than relying only on simple indicators such as IP addresses or event counts.

This thesis presents the Bot Detection and Behavioral Profiling Framework, a scalable and interpretable approach for analyzing large-scale Secure Shell (SSH) honeypot data to detect bots, understand attacker behavior, and identify coordinated attack campaigns. Modern attackers often rely on automation, which creates large amounts of noisy and complex data that are difficult to analyze directly. To address this, the proposed framework transforms raw honeypot logs into structured behavioral insights through three main stages: preprocessing, command normalization, and attacker profiling.

First, the raw data is cleaned and organized into meaningful sessions. A graph-based masking method then separates stable parts of commands from changing elements, which reduces noise while preserving important behavior. Next, a rule-based grouping method removes repeated sessions and improves efficiency. Finally, a behavior-based detection engine identifies automated attackers and builds attacker profiles based on their actions, timing, and intent. These profiles are used to construct an attacker similarity graph to reveal groups of attackers with similar behavior.

The framework is evaluated by using an eleven-month Cowrie honeypot dataset with more than 1.5 million command interactions. The results show that the framework reduces similarity computations by 94.79% and achieves a bot detection accuracy of 94.89%. Overall, this work demonstrates how raw honeypot data can be transformed into useful, campaign-level security insights.