Two-view honeypot framework for behavioral analysis of consumer IoT attack campaigns

Internet-facing consumer Internet of Things (IoT) devices are probed and compromised at scale, yet converting raw honeypot logs into clear evidence about how attacks operate and which sessions belong to the same campaign remains difficult, especially without labels. In this work, we present a scalable two-view pipeline applied to one year of Cowrie SSH/Telnet logs that emulate vulnerable IoT endpoints (1.77M sessions; 3.67M command events). In the behavior view, we encode each session's command sequence with an E5 encoder, reduce to 50 dimensions via Incremental PCA, and cluster the corpus with MiniBatchKMeans (k=250). On a 97k stratified sample, we observe high Silhouette and clear exemplars, and the full run completes in minutes on research hardware. As a robustness check, HDBSCAN on ~4×105 sessions discovers 44 dense groups with 13.94% labeled as noise. In the infrastructure view, we independently extract normalized URLs, domains, IPv4s, and SHA-256 hashes, build a 14-day time-windowed artifact-sharing graph with type-weighted edges and degree caps, and detect communities with Louvain. A representative graph has 250,043 nodes and 1,575,383 edges; its giant component has 18,938 nodes and 102,289 edges, revealing distinct, bursty communities that target IoT devices. Comparing views for overlap yields a low Adjusted Rand Index (0.019 at ≈ 1.07% coverage), indicating they capture complementary structure; similar workflows need not reuse the same infrastructure, and vice versa. We package outputs as a compact "findings pack"per large community (top artifacts, exemplar command snippets, and weekly activity curves). Overall, the pipeline offers a practical path from raw IoT honeypot logs to campaign-level insight without supervision.