What are Attackers after on IoT Devices? An approach based on a
  multi-phased multi-faceted IoT honeypot ecosystem and data clustering
  The growing number of Internet of Things (IoT) devices makes it imperative to
be aware of the real-world threats they face in terms of cybersecurity. While
honeypots have been historically used as decoy devices to help
researchers/organizations gain a better understanding of the dynamic of threats
on a network and their impact, IoT devices pose a unique challenge for this
purpose due to the variety of devices and their physical connections. In this
work, by observing real-world attackers' behavior in a low-interaction honeypot
ecosystem, we (1) presented a new approach to creating a multi-phased,
multi-faceted honeypot ecosystem, which gradually increases the sophistication
of honeypots' interactions with adversaries, (2) designed and developed a
low-interaction honeypot for cameras that allowed researchers to gain a deeper
understanding of what attackers are targeting, and (3) devised an innovative
data analytics method to identify the goals of adversaries. Our honeypots have
been active for over three years. We were able to collect increasingly
sophisticated attack data in each phase. Furthermore, our data analytics points
to the fact that the vast majority of attack activities captured in the
honeypots share significant similarity, and can be clustered and grouped to
better understand the goals, patterns, and trends of IoT attacks in the wild.
