The rapid expansion of information and communication technologies brings not only new opportunities but also an increasing number of sophisticated and technologically advanced cyber threats. A growing number of interconnected systems expands the potential attack surface, while the accumulation and transmission of sensitive data increase the risk of data leaks and unauthorized access. Cyberattacks are becoming increasingly automated, with attackers leveraging advanced toolkits, reusing previously leaked credentials, and operating from distributed and anonymized networks. These characteristics significantly hinder the timely detection and understanding of real-world attacks, especially as their scientific evaluation is often limited to post-mortem forensic analyses or simulated attack scenarios.
This dissertation addresses the problem of cyberattack modeling based on publicly available datasets and honeypot systems that enable real-time capture of real-world attack traffic. The research focuses on the development of a methodological framework and tools for integration and analysis of heterogeneous data sources, enabling their normalization and analysis to reveal attack patterns, behavioral similarities, and connections between the attackers. The existing laboratory infrastructure—a network telescope and honeypot systems for SSH and Telnet protocols—was extended with newly developed HTTP-based honeypot services and a data processing pipeline for filtering and normalization of data, enabling their integration into a unified platform for the analysis and modeling of cyberattacks. By combining internal and external data sources with existing and newly developed tools, we designed a comprehensive platform for attack data collection, processing, and visualization. We captured millions of events on honeypots and retrieved several billion authentication credentials from publicly available sources. We enriched the collected attack data records to systematically describe the involved attack entities and actions, and cross-compared the collected datasets.
We analyzed the collected data, including by modeling the flow of the attacks, identifying attacker infrastructure and campaign-based behavior, and comparing the passwords used in attacks to leaked credentials and known password wordlists. We examined password structures, generative algorithms, and listed the most common intrusion attempts. We categorized the attacks based on initial access methods, traffic origins, temporal characteristics, issued shell commands during interactive sessions, and delivered and executed malicious code. We developed an attack model and an interactive graph-based tool for cyberattack visualization, which structures the attacks as participating entities interconnected by the attacker actions. The model enables visual analysis of attack phases and classification between human and automated adversaries. The developed tools enable continuous monitoring of emerging attacks and real-time export of their crucial indicators to defensive solutions—such as firewalls—to enhance network protection.
The research results confirm that the integratoin of diverse data sources and deployment of highly-interactive distributed honeypots are highly valuable for identifying attack characteristics and behavioral patterns of the attackers. The dissertation contributes to modeling and analysis of modern cyberattacks and offers tools for advancing current approaches to threat detection.
|
