Data analyzer based on data mining for Honeypot Router

Honeypot is an effective security tool, which is intended to be attacked and compromised to gain more information about the attacker and his attack techniques. To study these attacks, the honeypot must capture and log large amounts of data which are very difficult to process manually. So, the analysis of these logs has become a very difficult and time consuming task. To resolve this problem, several researchers have proposed the use of data mining techniques in order to classify logged traffic and extract useful information. In this paper, we present a data analysis tool for our Honeypot Router. This tool is based on data mining clustering. The main idea is to extract useful features from data captured by the Honeypot Router. These data will be then clustered by using the DBSCAN clustering algorithm in order to classify the captured packets and extract those that are suspicious. Suspicious packets will be then verified by a human expert. This solution is very useful to detect novel routing attacks.