Analyzing the medium-interaction honeypot: A case study

Internet usage in all regions of the world is increasing day by day. Cybercrime along with the growth in number of online users are potential risks for data leakage. Universities and governmental entities are especially the main targets of cyberattacks throughout the world. If an attacker and his behavior are known, one can efficiently defend a system. Honeypot is a fake service that gives logical responses that help to fetch information about the entire shell interaction of an attacker. Honeypot is an essential tool for cyberattack monitoring to analyze how we encounter attackers. Kippo, a medium-interaction SSH honeypot written in Python, is used to log brute-force attacks. In order to visualize statistics from log files, Kippo-Graph is also used as a real-time log analyzer. This thesis presents the results and attackers' behavior from a study from which Kippo data logs were taken for approximately a six-month monitoring period in the network infrastructure in Turkey.