Semantic Similarities for Honeypot Collected Linux Shell Commands

Shell commands are among the most popular tools used by attackers to execute cyber-attacks, given that most servers in the world run on Linux and operate using shell commands. Understanding how attackers work can be a challenge for researchers and investigators, particularly when it comes to filtering out malicious commands from a vast amount of data. Honeypots are one type of deception solution used to trap attackers without damaging the inter-connected system. Furthermore, we will be able to learn behaviors from the attacker and understand the correlation between one attack pattern and another. In cyber security, finding links between different event of attacks can be helpful for doing cyber attribution. Similarities in cyber-attack can provide evidence of several attacks coming from the same source. In this paper, we propose a method for identifying similarities between attackers based on Linux commands they used using semantic perspective represented in vector format.