Analysis of anomaly packet's feature based on honeypot

The deep study of anomaly feature based on the particular server was made in this paper. By continuously monitoring on the honeypot deployed in Internet Data Center for more than two months, the experimental results were summarized and some initial exploratory models were built. The models show that the number of attackers for the main attack types and ports can be described by normal distribution; meanwhile, the average packet number that each attacker generates per day can be described by log-normal distribution. This research aims to contribute to endeavor in the wider security research community to build methods and obtain some statistical models, grounded on strong empirical work, for assessment of the robustness of systems in hostile environments, and the anomaly traffic sampling, detection and classification on the backbone.