Predicting client-side attacks via behaviour analysis using honeypot data

In recent years, attackers have started to use web pages to deliver their malicious code to users. Web-based malware overcomes signature-based detection by modification of the code or using zero-day exploits. We propose a malicious activity detection method using Hidden Markov Models (HMM) alongside a client honeypot system. Our algorithm is able to detect the potential malicious behaviour of a web server based on current and past interactions between the web client and the server and can also predict possible future behaviours. The prediction algorithm learns from previously scanned behaviours recorded by a client honeypot system. We group such behaviours in order to enable common characteristics to be investigated across these groups.