Improving effectiveness of honeypots: predicting targeted destination port numbers during attacks using J48 algorithm

During recent years, there has been an increase in cyber-crime and cybercriminal activities around the world and as countermeasures, effective attack prevention and detection mechanisms are needed. A popular tool to augment existing attack detection mechanisms is the Honeypot. It serves as a decoy for luring attackers, with the purpose to accumulate essential details about the intruder and techniques used to compromise systems. In this endeavor, such tools need to effectively listen and keep track of ports on hosts such as servers and computers within networks. This paper investigates, analyzes and predicts destination port numbers targeted by attackers in order to improve the effectiveness of honeypots. To achieve the purpose of this paper, the J48 decision tree classifier was applied on a database containing information on cyber-attacks. Results revealed insightful information on key destination port numbers targeted by attackers, in addition to how these targeted ports vary within different regions around the world.

This version of the paper has been accepted for publication, after peer review and is subject to Springer Nature’s AM terms of use (https://www.springernature.com/gp/open-research/policies/accepted-ma...), but is not the Version of Record and does not reflect post-acceptance improvements, or any corrections. The Version of Record is available online at: http://dx.doi.org/10.1007/978-3-030-18240-3_21

Part of the Lecture Notes in Electrical Engineering book series (LNEE, volume 561)