Huge thanks also to everyone else who contributed over the past months — many of them appear by name below.
Since the v3 release post, a lot has changed. Thanks to all these new contributors, we modernised the project’s foundation, added loads of test cases, and shipped a number of new features. All of these are available in our latest release, 3.5.1 — here are some of the highlights:
gbctl setup/update script for easier installation, thanks to opbot-xd.Special thanks to rahulgunwanistudy-2005 for an impressively efficient data migration that normalises credentials into a separate model.
]]>The core of my work is the development and comparison of scoring models which try to predict future honeypot interactions. As a result of this comparison, two of these models were integrated into GreedyBear and already do their work on the Honeynet instance:
The first model is a Random Forest classifier, a machine learning model that predicts binary events. In our case, for each known IP address it estimates the probability that this IP address will hit any honeypot in the next 24 hours. GreedyBear now offers a feed that orders its entries by that probability such that the most likely IP addresses to reoccur are at the top of the list.
The second model, a Random Forest regressor, predicts the number of honeypot hits that we can expect from an IP address in the next 24 hours. Analogous to the “likely to reoccur” feed from the classifier model, GreedyBear now also offers the “most expected hits” feed which is based on the prediction of the regressor model.
Both predictions, along with some other new information, are also included in every ‘json’ based GreedyBear feed. For details about the different feeds and their contents, please refer to the documentation.
The Cowrie honeypot records the sequence of commands which an attacker executes during a SSH session. These command sequences and their relation to the IP addresses which executed them, are now also extracted and stored by GreedyBear. The new command sequence API supports two kinds of requests:
In addition there is a clustering feature, which groups similar command sequences together, allowing for a “fuzzy” search using the ‘include_similar’ query parameter. If this parameter is used, the result will also contain IP addresses that executed similar command to the one requested. In my testing, this feature allowed me to attribute more than 2000 IP addresses to the ‘mdrfckr’ botnet on my personal instance of GreedyBear. On the Honeynet instance, the clustering feature is currently not activated, as it is very resource hungry. I’ll try to make it more efficient soon(ish). :)
If you are interested in reading into my full thesis, you can find it here. If you want to get in touch, you can find me on Mastodon.
]]>Started as a personal Christmas project from Matteo Lodi, since then GreedyBear is being improved mainly thanks to the efforts of the Certego Threat Intelligence Team.
It has been evolved to a fully operational web application which provides convenient ways to explore and search extracted data and fully fledged API REST to programmatically extract them.
Thanks to the efforts of The Honeynet Project, we have a public site which allows us to share the data collected from the TPOTs of this organization. Check the official site here!
Happy hunting!
]]>