← cd ~
ogurexxx@root:~$ ./experiment.sh
Lab
Every day the honeypot looks different: the server name and the system version in its banner change. The hypothesis: bots react more to a “production” server than to a backup one. We test it on real bots.
Finding: not enough data, 14 days per variant needed · today: srv-backup01
Method
- Variants rotate daily at 04:30 Moscow time. Frequent rotation reduces the effect of attack waves that last for weeks.
- The main metric is sessions with commands per day, shown with its standard error.
- A finding appears at 14 days per variant and a gap above two standard errors.
What can skew the result
- Variants differ in two ways at once, so it is impossible to say which one worked.
- A bot sees the server name only after login, but the banner immediately.
- Bots that scanned the server on another day may return and land in a different variant.
- Comparing three variants makes chance differences more likely, so a finding is a reason to test further, not proof.