Operator Attribution
Experimental Analysis
Attackers Leave a
Timing Fingerprint
Even when attackers rotate IPs, their inter-command timing stays constant - set by sleep() calls in their scripts or natural typing rhythms. We clustered 2,104 real Cowrie sessions by timing alone and found consistent operator signatures across hundreds of unrelated IP addresses.
2,104Sessions Analyzed
-Operator Clusters
-Cross-IP Clusters
-IPs, One Fingerprint
PCA Projection — Timing Feature Space