Improving Effectiveness of Honeypots: Predicting Targeted Destination Port Numbers During Attacks Using J48 Algorithm

摘要

During recent years, there has been an increase in cyber-crime and cybercriminal activities around the world and as countermeasures, effective attack prevention and detection mechanisms are needed. A popular tool to augment existing attack detection mechanisms is the Honeypot. It serves as a decoy for luring attackers, with the purpose to accumulate essential details about the intruder and techniques used to compromise systems. In this endeavor, such tools need to effectively listen and keep track of ports on hosts such as servers and computers within networks. This paper investigates, analyzes and predicts destination port numbers targeted by attackers in order to improve the effectiveness of honeypots. To achieve the purpose of this paper, the J48 decision tree classifier was applied on a database containing information on cyber-attacks. Results revealed insightful information on key destination port numbers targeted by attackers, in addition to how these targeted ports vary within different regions around the world.