Cyber bots have become prevalent across the Internet ecosystem, making behavioral understanding essential for threat intelligence. Since bot behaviors are encoded in traffic payloads that blend with normal traffic, honeypot sensors are widely adopted for capture and analysis. However, previous works face adaptation challenges when analyzing large-scale, diverse payloads from evolving bot techniques. In this paper, we conduct an 11-month measurement study to map cyber bot behaviors through payload pattern analysis in honeypot traffic. We propose TrafficPrint, a pattern extraction framework to enable adaptable analysis of diverse honeypot payloads. TrafficPrint combines representation learning with clustering to automatically extract human-understandable payload patterns without requiring protocol-specific expertise. Our globally distributed honeypot sensors collected 21.5 M application-layer payloads. Starting from only 168 K labeled payloads (0.8% of data), TrafficPrint extracted 296 patterns that automatically labeled 83.57% of previously unknown payloads. Our pattern-based analysis reveals actionable threat intelligence: 82% of patterns employ semi-customized structures balancing automation with targeted modifications; 13% contain distinctive identity markers enabling threat actor attribution, including CENSYS’s unique signature; and bots exploit techniques like masquerading as crawlers, embedding commands in brute-force attacks, and using base64 encoding for detection evasion.

As cyberspace continues to expand, identifying the organization or individual behind a website has become increasingly vital in security incident response, phishing website detection, and other cybersecurity subfields. An existing solution for it involves analyzing webpage content and extracting owner names using named entity recognition techniques. However, since these techniques operate on a sentence-by-sentence basis, they struggle to identify the true owner when multiple individual or organizational names appear on a webpage. Moreover, they often perform poorly on non-English websites. To address these limitations, we propose OwnerHunter,1 a novel multilingual framework powered by large language models, which formulates website owner identification as a multilingual document-level information extraction task and utilizes global information from webpages to identify the owner. In OwnerHunter, we first craft prompts that fully leverage the capabilities of large language models to effectively recognize potential owners on webpages in different languages with minimal examples. To enhance the comprehensiveness and accuracy of recognition, we further design a multimodal augmentation strategy, an example pool strategy, and a self-verification strategy. Then, we devise a semantic and string similarity aggregation-based entity disambiguation technique to eliminate ambiguities among multiple potential owners recognized by large language models and a position-based hybrid ranking technique to exactly select the true owner. To evaluate OwnerHunter, we refine the publicly available English dataset ONER and construct the Chinese dataset WOI-cn with 16,036 real websites. Experimental results show that OwnerHunter achieves F1 scores of 0.9505 on ONER and 0.9621 on WOI-cn, setting new state-of-the-art performance on both datasets.¹Codes are available at https://github.com/tuchen9/OwnerHunter

Hosts generating unsolicited network traffic increasingly operate in a coordinated manner rather than in isolation. Scanning and exploitation activities are often distributed across multiple hosts that share common infrastructure, toolchains, and behavioral patterns, forming loosely coupled yet persistently aligned sender groups. Accurately attributing such groups is critical for understanding organized activities and strengthening network defense capabilities. However, existing attribution approaches face notable limitations. Methods that rely on threat intelligence suffer from delayed updates and limited coverage. Static feature-based approaches ignore temporal ordering and therefore fail to capture multi-stage behavioral evolution. Although dynamic sequence models incorporate temporal patterns, they typically overlook the collaborative structural relationships among coordinated senders. In this paper, we propose SentinelGraph, a temporal graph reasoning framework for sender group attribution from honeypot traffic. SentinelGraph constructs a temporal knowledge graph and integrates a recurrent graph evolution module to jointly model coordination structures and their temporal dynamics. A structure enhancement module further exploits contextual information available at the target time, while an auxiliary relation loss encourages the learning of enriched entity representations. This design enables accurate attribution even for previously unseen senders by leveraging information from their observed neighbors. Experiments on real-world honeypot data demonstrate that SentinelGraph substantially outperforms state-of-the-art methods in modeling coordinated network behaviors.