Analyzing Cyberattack Patterns Using Cowrie Honeypot Deployed on a Raspberry Pi 5
Restu Alsyafiq Selian, Muhammad Naufal Azzahri, Sayed Muchallil, Yudha Nurdin, Razief Perucha Fauzie Afidh, Khairul Umam, Rahmad Dawood · 2024
Honeypots are essential tools in cybersecurity for monitoring, understanding, and mitigating cyber threats. This study examines attack patterns and commands executed by attackers within the Cowrie honeypot, which simulates interactive SSH and Telnet environments. Analyzing over 805,000 log entries collected over one month, this research identifies frequently used commands, session durations, and trends in attack frequency. Key findings reveal a strong preference for SSH over Telnet, with SSH commonly used in rapid, automated attacks, whereas Telnet sessions often involve longer, exploratory interactions. The study also highlights spikes in attack frequency, with over 100,000 attacks recorded on August 6, 2024. These insights enhance our understanding of attacker behavior and support improvements in intrusion detection and prevention systems.