{"id":"https://openalex.org/W3048347571","doi":"https://doi.org/10.1109/cns48642.2020.9162326","title":"Towards Data-Driven Characterization of Brute-Force Attackers","display_name":"Towards Data-Driven Characterization of Brute-Force Attackers","publication_year":2020,"publication_date":"2020-06-01","ids":{"openalex":"https://openalex.org/W3048347571","doi":"https://doi.org/10.1109/cns48642.2020.9162326","mag":"3048347571"},"language":"en","primary_location":{"id":"doi:10.1109/cns48642.2020.9162326","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns48642.2020.9162326","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5091520073","display_name":"Florian Wilkens","orcid":"https://orcid.org/0000-0003-2300-4293"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Florian Wilkens","raw_affiliation_strings":["Universit\u00e4t Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universit\u00e4t Hamburg","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033270363","display_name":"Mathias Fischer","orcid":"https://orcid.org/0000-0002-6254-8288"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Mathias Fischer","raw_affiliation_strings":["Universit\u00e4t Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universit\u00e4t Hamburg","institution_ids":["https://openalex.org/I159176309"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I159176309"],"apc_list":null,"apc_paid":null,"fwci":0.2342,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.37255412,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9958000183105469,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9958000183105469,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7810195684432983},{"id":"https://openalex.org/keywords/login","display_name":"Login","score":0.7506700158119202},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.7430476546287537},{"id":"https://openalex.org/keywords/collusion","display_name":"Collusion","score":0.6438363790512085},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6297056674957275},{"id":"https://openalex.org/keywords/brute-force-attack","display_name":"Brute-force attack","score":0.6161383390426636},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5185166597366333},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4969020187854767},{"id":"https://openalex.org/keywords/brute-force","display_name":"Brute force","score":0.4566541910171509},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.43475914001464844},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.21755757927894592},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.15048784017562866},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.13251453638076782}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7810195684432983},{"id":"https://openalex.org/C113324615","wikidata":"https://www.wikidata.org/wiki/Q472302","display_name":"Login","level":2,"score":0.7506700158119202},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.7430476546287537},{"id":"https://openalex.org/C2781198186","wikidata":"https://www.wikidata.org/wiki/Q701521","display_name":"Collusion","level":2,"score":0.6438363790512085},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6297056674957275},{"id":"https://openalex.org/C207468940","wikidata":"https://www.wikidata.org/wiki/Q869370","display_name":"Brute-force attack","level":3,"score":0.6161383390426636},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5185166597366333},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4969020187854767},{"id":"https://openalex.org/C2986801135","wikidata":"https://www.wikidata.org/wiki/Q1209494","display_name":"Brute force","level":2,"score":0.4566541910171509},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.43475914001464844},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.21755757927894592},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.15048784017562866},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.13251453638076782},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C175444787","wikidata":"https://www.wikidata.org/wiki/Q39072","display_name":"Microeconomics","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cns48642.2020.9162326","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns48642.2020.9162326","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6399999856948853,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W1673310716","https://openalex.org/W1995875735","https://openalex.org/W1997149057","https://openalex.org/W2030278443","https://openalex.org/W2038807247","https://openalex.org/W2101234009","https://openalex.org/W2103487196","https://openalex.org/W2122803863","https://openalex.org/W2147514835","https://openalex.org/W2158880761","https://openalex.org/W2246402135","https://openalex.org/W2318029894","https://openalex.org/W2791879367","https://openalex.org/W2810737462","https://openalex.org/W2947740622","https://openalex.org/W3122507336","https://openalex.org/W6675354045","https://openalex.org/W6691149816","https://openalex.org/W6788793748","https://openalex.org/W6927096650"],"related_works":["https://openalex.org/W3188902280","https://openalex.org/W4226466313","https://openalex.org/W3136039078","https://openalex.org/W4382399242","https://openalex.org/W1551862606","https://openalex.org/W2464214798","https://openalex.org/W4402567901","https://openalex.org/W3142500634","https://openalex.org/W2392880310","https://openalex.org/W3006471040"],"abstract_inverted_index":{"Brute-force":[0],"login":[1,74,114],"attempts":[2,115],"are":[3],"common":[4,96,133],"for":[5,154,159],"every":[6],"host":[7],"on":[8,77,107],"the":[9,36,44,83,146,172],"public":[10],"Internet.":[11],"While":[12],"most":[13],"of":[14,64,112,149,171],"them":[15],"can":[16,67,88,128,175],"be":[17,129],"discarded":[18],"as":[19],"low-threat":[20],"attacks,":[21],"targeted":[22],"attack":[23,30],"campaigns":[24],"often":[25],"use":[26],"a":[27,33,62,108,169],"dictionary-based":[28],"brute-force":[29,73],"to":[31,42,47,53,90,94,131,144,177],"establish":[32],"foothold":[34],"in":[35,71],"network.":[37],"Therefore,":[38],"it":[39],"is":[40],"important":[41],"characterize":[43],"attackers'":[45],"behavior":[46,97,134],"prioritize":[48],"defensive":[49],"measures":[50],"and":[51,82,93,138],"react":[52],"new":[54],"threats":[55],"quickly.":[56],"In":[57],"this":[58],"paper":[59],"we":[60,153],"present":[61],"set":[63,111],"metrics":[65,87,106,142,174],"that":[66,168],"support":[68],"threat":[69,147],"hunters":[70],"characterizing":[72],"attempts.":[75],"Based":[76],"connection":[78],"metadata,":[79],"timing":[80],"information,":[81],"attacker's":[84],"dictionary":[85],"these":[86],"help":[89,143,176],"differentiate":[91],"scans":[92],"find":[95],"across":[98,135],"distinct":[99],"IP":[100,136,165],"addresses.":[101],"We":[102,121],"evaluated":[103],"our":[104,118],"novel":[105],"real-world":[109],"data":[110],"malicious":[113],"collected":[116],"by":[117],"honeypot":[119],"Honeygrove.":[120],"highlight":[122],"interesting":[123],"metrics,":[124],"show":[125],"how":[126,140],"clustering":[127,170],"leveraged":[130],"reveal":[132,178],"addresses,":[137],"describe":[139],"selected":[141],"assess":[145],"level":[148],"attackers.":[150],"Amongst":[151],"others,":[152],"example":[155],"found":[156],"strong":[157],"indicators":[158],"collusion":[160],"between":[161],"ten":[162],"otherwise":[163],"unrelated":[164],"addresses":[166],"confirming":[167],"right":[173],"coordinated":[179],"attacks.":[180]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2021,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}