Cowrie Honeypot Analysis
480,998 events from a Cowrie honeypot, and the question was what they actually show.
Academic security analysis. Python analysis, visualisation and report preparation.
A login attempt on its own says very little, so the work went from aggregate counts down to sessions, because a session is what connects the attempt to the commands after it.
Charts cover timing, ports, credentials and command use, with query tools for looking closer at anything odd. The reports stay at the aggregate level, so individual addresses aren't reproduced.
State
Two reports and the analysis code, from October 2025.