

{"id":1507,"date":"2012-07-12T14:33:20","date_gmt":"2012-07-12T19:33:20","guid":{"rendered":"http:\/\/rud.is\/b\/?p=1507"},"modified":"2018-03-10T07:53:38","modified_gmt":"2018-03-10T12:53:38","slug":"ssh-password-time-series-heatmap-in-d3","status":"publish","type":"post","link":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/","title":{"rendered":"SSH Password Time-series Heatmap In D3"},"content":{"rendered":"<p>In @jayjacobs&#8217; <a href=\"https:\/\/www.verizonenterprise.com\/verizon-insights-lab\/?t=securityblog\">latest post on SSH honeypot passsword analysis<\/a> he shows some spiffy visualizations from crunching the data with Tableau. While I&#8217;ve joked with him and called them &#8220;robocharts&#8221;, the reality is that Tableau does let you work on visualizing the answers to questions quickly without having to go into &#8220;code mode&#8221; (and that doesn&#8217;t make it wrong).<\/p>\n<p>I&#8217;ve been using Jay&#8217;s <span class=\"removed_link\" title=\"https:\/\/dl.dropboxusercontent.com\/u\/43553\/ssh-pw.csv.zip\">honeypot data<\/span> for both attack analysis as well as an excuse to compare data crunching and visualization tools (so far I&#8217;ve poked at it with R and python) in an effort to see what tools are good for exploring various types of questions.<\/p>\n<p>A question that came to mind recently was &#8220;<i>Hmmm\u2026I wonder if there is a patten to the timings of probes\/attacks?<\/i>&#8221; and I posited that a time-series view across the days would help illustrate that. To that end, I came up with the idea of breaking the attacks into one hour chuncks and build a day-stacked heatmap which could be filtered by country. Something like this:<\/p>\n<p><center><a href=\"https:\/\/rud.is\/passheat\/\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" data-attachment-id=\"1508\" data-permalink=\"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/heatslice\/\" data-orig-file=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png?fit=407%2C647&amp;ssl=1\" data-orig-size=\"407,647\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;}\" data-image-title=\"heatslice\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png?fit=407%2C647&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png?resize=407%2C647&#038;ssl=1\" alt=\"\" title=\"heatslice\" width=\"407\" height=\"647\" class=\"aligncenter size-full wp-image-1508\" srcset=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png?w=407&amp;ssl=1 407w, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png?resize=188%2C300&amp;ssl=1 188w\" sizes=\"auto, (max-width: 407px) 100vw, 407px\" \/><\/a><\/center><\/p>\n<p>I&#8217;ve been wanting to play with <a href=\"https:\/\/d3js.org\/\">D3<\/a> and exploring this concept with it seemed to be a good fit.<\/p>\n<p>Given that working with the real data would entail loading a ~4MB file every time someone viewed this blog post, I put the working example <a href=\"https:\/\/rud.is\/passheat\/\">in a separate page<\/a> where you can do a &#8220;view source&#8221; to see the code. Without the added complexity of a popup selector and loading spinner, the core code is about 50 lines, much of which could be condensed even further since it&#8217;s just chaining calls in javascript. I cheated a bit and used jQuery, too, plus made some of it dependent on WebKit (the legend may look weird in Firefox) due to time constraints.<\/p>\n<p>The library is wicked simple to grok and makes it easy to come up with new ways to look at data (as you can see from the examples gallery on the D3 site).<\/p>\n<p>Unfortunately, no real patterns emerged, but I&#8217;m going to take a stab at taking the timestamps (which is the timestamp at the destination of the attack) and align it to the origin to see if that makes a difference in the view. If that turns up anything interesting, I&#8217;ll make another quick post on it.<\/p>\n<p>Given that much of data (&#8220;big&#8221; or otherwise) analysis is domain knowledgable folk asking interesting questions, are there any folks out there who have questions that they&#8217;d like to see explored with this data set?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In @jayjacobs&#8217; latest post on SSH honeypot passsword analysis he shows some spiffy visualizations from crunching the data with Tableau. While I&#8217;ve joked with him and called them &#8220;robocharts&#8221;, the reality is that Tableau does let you work on visualizing the answers to questions quickly without having to go into &#8220;code mode&#8221; (and that doesn&#8217;t [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":3,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":""},"categories":[24,666,3],"tags":[752,667,665,668],"class_list":["post-1507","post","type-post","status-publish","format-standard","hentry","category-charts-graphs","category-d3","category-information-security","tag-d3","tag-heatmap","tag-honeypot","tag-passwords"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>SSH Password Time-series Heatmap In D3 - rud.is<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SSH Password Time-series Heatmap In D3 - rud.is\" \/>\n<meta property=\"og:description\" content=\"In @jayjacobs&#8217; latest post on SSH honeypot passsword analysis he shows some spiffy visualizations from crunching the data with Tableau. While I&#8217;ve joked with him and called them &#8220;robocharts&#8221;, the reality is that Tableau does let you work on visualizing the answers to questions quickly without having to go into &#8220;code mode&#8221; (and that doesn&#8217;t [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/\" \/>\n<meta property=\"og:site_name\" content=\"rud.is\" \/>\n<meta property=\"article:published_time\" content=\"2012-07-12T19:33:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-03-10T12:53:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png\" \/>\n<meta name=\"author\" content=\"hrbrmstr\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"hrbrmstr\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/\"},\"author\":{\"name\":\"hrbrmstr\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"headline\":\"SSH Password Time-series Heatmap In D3\",\"datePublished\":\"2012-07-12T19:33:20+00:00\",\"dateModified\":\"2018-03-10T12:53:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/\"},\"wordCount\":429,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"image\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2012\\\/07\\\/heatslice.png\",\"keywords\":[\"d3\",\"heatmap\",\"honeypot\",\"passwords\"],\"articleSection\":[\"Charts &amp; Graphs\",\"d3\",\"Information Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/\",\"name\":\"SSH Password Time-series Heatmap In D3 - rud.is\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2012\\\/07\\\/heatslice.png\",\"datePublished\":\"2012-07-12T19:33:20+00:00\",\"dateModified\":\"2018-03-10T12:53:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2012\\\/07\\\/heatslice.png?fit=407%2C647&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2012\\\/07\\\/heatslice.png?fit=407%2C647&ssl=1\",\"width\":\"407\",\"height\":\"647\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/07\\\/12\\\/ssh-password-time-series-heatmap-in-d3\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/rud.is\\\/b\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SSH Password Time-series Heatmap In D3\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/\",\"name\":\"rud.is\",\"description\":\"&quot;In God we trust. All others must bring data&quot;\",\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/rud.is\\\/b\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\",\"name\":\"hrbrmstr\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"width\":460,\"height\":460,\"caption\":\"hrbrmstr\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\"},\"description\":\"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7\",\"sameAs\":[\"http:\\\/\\\/rud.is\"],\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/author\\\/hrbrmstr\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SSH Password Time-series Heatmap In D3 - rud.is","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/","og_locale":"en_US","og_type":"article","og_title":"SSH Password Time-series Heatmap In D3 - rud.is","og_description":"In @jayjacobs&#8217; latest post on SSH honeypot passsword analysis he shows some spiffy visualizations from crunching the data with Tableau. While I&#8217;ve joked with him and called them &#8220;robocharts&#8221;, the reality is that Tableau does let you work on visualizing the answers to questions quickly without having to go into &#8220;code mode&#8221; (and that doesn&#8217;t [&hellip;]","og_url":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/","og_site_name":"rud.is","article_published_time":"2012-07-12T19:33:20+00:00","article_modified_time":"2018-03-10T12:53:38+00:00","og_image":[{"url":"https:\/\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png","type":"","width":"","height":""}],"author":"hrbrmstr","twitter_card":"summary_large_image","twitter_misc":{"Written by":"hrbrmstr","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/#article","isPartOf":{"@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/"},"author":{"name":"hrbrmstr","@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"headline":"SSH Password Time-series Heatmap In D3","datePublished":"2012-07-12T19:33:20+00:00","dateModified":"2018-03-10T12:53:38+00:00","mainEntityOfPage":{"@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/"},"wordCount":429,"commentCount":1,"publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"image":{"@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/#primaryimage"},"thumbnailUrl":"https:\/\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png","keywords":["d3","heatmap","honeypot","passwords"],"articleSection":["Charts &amp; Graphs","d3","Information Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/","url":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/","name":"SSH Password Time-series Heatmap In D3 - rud.is","isPartOf":{"@id":"https:\/\/rud.is\/b\/#website"},"primaryImageOfPage":{"@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/#primaryimage"},"image":{"@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/#primaryimage"},"thumbnailUrl":"https:\/\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png","datePublished":"2012-07-12T19:33:20+00:00","dateModified":"2018-03-10T12:53:38+00:00","breadcrumb":{"@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/#primaryimage","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png?fit=407%2C647&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/07\/heatslice.png?fit=407%2C647&ssl=1","width":"407","height":"647"},{"@type":"BreadcrumbList","@id":"https:\/\/rud.is\/b\/2012\/07\/12\/ssh-password-time-series-heatmap-in-d3\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/rud.is\/b\/"},{"@type":"ListItem","position":2,"name":"SSH Password Time-series Heatmap In D3"}]},{"@type":"WebSite","@id":"https:\/\/rud.is\/b\/#website","url":"https:\/\/rud.is\/b\/","name":"rud.is","description":"&quot;In God we trust. All others must bring data&quot;","publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rud.is\/b\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886","name":"hrbrmstr","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","width":460,"height":460,"caption":"hrbrmstr"},"logo":{"@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1"},"description":"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7","sameAs":["http:\/\/rud.is"],"url":"https:\/\/rud.is\/b\/author\/hrbrmstr\/"}]}},"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p23idr-oj","jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":1412,"url":"https:\/\/rud.is\/b\/2012\/06\/28\/honeypot-analytics\/","url_meta":{"origin":1507,"position":0},"title":"Honeypot Analytics","author":"hrbrmstr","date":"2012-06-28","format":false,"excerpt":"For this post (and probably a few subsequent ones), I'm taking the role of 'Pinky\" to @jayjacobs' 'Brain' as I share some of my own analysis on the ssh honeypot passwords that Jay collected (you'll need to read his VZB post before continuing). There are tons of angles for analysis\u2026","rel":"","context":"In &quot;Information Security&quot;","block_context":{"text":"Information Security","link":"https:\/\/rud.is\/b\/category\/information-security\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2288,"url":"https:\/\/rud.is\/b\/2013\/03\/10\/visualizing-risky-words-part-3\/","url_meta":{"origin":1507,"position":1},"title":"Visualizing Risky Words \u2014 Part 3","author":"hrbrmstr","date":"2013-03-10","format":false,"excerpt":"The DST changeover in the US has made today a fairly strange one, especially when combined with a very busy non-computing day yesterday. That strangeness manifest as a need to take the D3 heatmap idea mentioned in the [previous post](http:\/\/rud.is\/b\/2013\/03\/09\/visualizing-risky-words-part-2\/) and actually (mostly) implement it. Folks just coming to this\u2026","rel":"","context":"In &quot;d3&quot;","block_context":{"text":"d3","link":"https:\/\/rud.is\/b\/category\/d3\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2896,"url":"https:\/\/rud.is\/b\/2014\/02\/09\/data-driven-security-roundup-betapert-shiny-honeypots-passwords-reproducible-research\/","url_meta":{"origin":1507,"position":2},"title":"Data Driven Security Roundup: betaPERT, Shiny, Honeypots, Passwords &#038; Reproducible Research","author":"hrbrmstr","date":"2014-02-09","format":false,"excerpt":"Jay Jacobs (@jayjacobs)\u2014my co-author of the soon-to-be-released book [Data-Driven Security](http:\/\/amzn.to\/ddsec)\u2014& I have been hard at work over at the book's [sister-blog](http:\/\/dds.ec\/blog) cranking out code to help security domain experts delve into the dark art of data science. We've covered quite a bit of ground since January 1st, but I'm using\u2026","rel":"","context":"In &quot;Data Analysis&quot;","block_context":{"text":"Data Analysis","link":"https:\/\/rud.is\/b\/category\/data-analysis-2\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2590,"url":"https:\/\/rud.is\/b\/2013\/08\/21\/zeroaccess-bots-desperately-seeking-freedom-visualization\/","url_meta":{"origin":1507,"position":3},"title":"ZeroAccess Bots Desperately Seeking Freedom (Visualization)","author":"hrbrmstr","date":"2013-08-21","format":false,"excerpt":"I've been doing a bit of graphing (with real, non-honeypot network data) as part of the research for the book I'm writing with @jayjacobs and thought one of the images was worth sharing (especially since it may not make it into the book :-). Click image for larger view This\u2026","rel":"","context":"In &quot;Data Visualization&quot;","block_context":{"text":"Data Visualization","link":"https:\/\/rud.is\/b\/category\/data-visualization\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1490,"url":"https:\/\/rud.is\/b\/2012\/07\/09\/honeypot-analytics-500-pretty-passwords\/","url_meta":{"origin":1507,"position":4},"title":"Honeypot Analytics : 500 Pretty Passwords","author":"hrbrmstr","date":"2012-07-09","format":false,"excerpt":"I had a few moments this past weekend to play with an idea for visualizing the passwords used against the honeypot @jayjacobs set up. While it's not as informative as Jay's weekend endeavors: https:\/\/twitter.com\/jayjacobs\/status\/221591674797826048 it is pretty, and it satisfied my need to make a word cloud out of useful\u2026","rel":"","context":"In &quot;Charts &amp; Graphs&quot;","block_context":{"text":"Charts &amp; Graphs","link":"https:\/\/rud.is\/b\/category\/charts-graphs\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2190,"url":"https:\/\/rud.is\/b\/2013\/02\/27\/follow-upresources-grc-t18-data-analysis-and-visualization-for-security-professionals-rsac\/","url_meta":{"origin":1507,"position":5},"title":"Follow up\/Resources :: GRC-T18 \u2013 Data Analysis and Visualization for Security Professionals #RSAC","author":"hrbrmstr","date":"2013-02-27","format":false,"excerpt":"Many thanks to all who attended the talk @jayjacobs & I gave at RSA on Tuesday, February 26, 2013. It was really great to be able to talk to so many of you afterwards as well. We've enumerated quite a bit of non-slide-but-in-presentation information that we wanted to aggregate into\u2026","rel":"","context":"In &quot;Charts &amp; Graphs&quot;","block_context":{"text":"Charts &amp; Graphs","link":"https:\/\/rud.is\/b\/category\/charts-graphs\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/1507","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/comments?post=1507"}],"version-history":[{"count":0,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/1507\/revisions"}],"wp:attachment":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/media?parent=1507"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/categories?post=1507"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/tags?post=1507"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}