Published research, stated limits

This paper presents a systematic observational study of threat actor behavior collected over a 10-day period using a purpose-built honeypot infrastructure presenting an industrial control system (ICS) persona to the public internet. The honeypot's SSH and Telnet logs recorded 8,292,401 discrete events; after excluding 66 scanner addresses (Censys and Google, classified as benign), 6,516 unique source IP addresses remain. The study profiles six categories of activity: two Mirai/Mozi-family malware variants, an Outlaw SSH key-injection operation, a Solana-themed credential cluster, a reconnaissance cluster that fingerprinted the host without delivering a payload, a cluster using a shared credential (3245gs5662d34), and web-exploit scanning. The Outlaw operation installed an SSH backdoor key (SHA256:MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cw) that has been documented in public reporting since at least 2023, showing that the campaign remained active in 2026 without rotating its key. Furthermore, the study identifies at least 20 payload servers (15 in the original analysis and 5 more in preserved command evidence) and multiple Mirai-family beacon strings, consistent with concurrent campaigns. HASSH fingerprinting groups source IPs that share SSH client software; the eight largest clusters are reported. The findings contribute to the understanding of threat actor behavior against an ICS-persona honeypot and provide actionable indicators of compromise (IOCs) for operational defenders.

• The first version described the Outlaw SSH backdoor key as previously undocumented. It has been publicly documented since at least 2023, and that claim is withdrawn.
• Beacon strings had been truncated, and several were paired with the wrong payload server. Only strings verified against preserved command evidence remain, and five more payload servers were added.
• The "APT-style" label, claims of statistical significance, and disclosure statements that could not be documented were removed. The title now describes the honeypot rather than ICS infrastructure.
• A new Data Availability section explains which figures were re-checked against retained evidence and which could not be.

The paper's revision note lists every change.

Beacon detection keyed on interval regularity alone produces an unmanageable false-positive rate, because benign periodic traffic—update polling, telemetry, time synchronization, keep-alives—is indistinguishable from command-and-control activity under a single timing signal. This paper presents a multi-signal correlation method that scores ten signals across Zeek connection, DNS, and TLS logs, spanning timing, volume, connection shape, certificate posture, and DNS behavior. Because a genuine C2 channel often exhibits several of these characteristics at once while benign services rarely do, rewarding cross-signal agreement is intended to separate the two. The trade-off is explicit: a channel that exhibits only one characteristic will score low (Section 7). Each signal is scored independently, weighted, mapped to an ATT&CK technique family, and reported with the evidence that produced it, yielding findings an analyst can audit rather than opaque scores. The method requires no SIEM, database, or agent and operates on a packet capture or Zeek log directory. It is implemented as the open-source tool beacon-score. This paper describes the method and its rationale; it does not report a quantitative evaluation.

• The abstract no longer says cross-signal agreement cuts false positives "without lowering sensitivity". The paper never showed that, and the trade-off is now stated.
• A new Stated Limitations section covers the absence of a quantitative evaluation, partial signal independence, approximate ATT&CK mappings, and input conditions.
• The example output now uses documentation-reserved IP addresses instead of real ones.

The paper's revision note lists every change.

Telephony failures on Android are diagnosed from a high-volume radio log in which the diagnostically significant events—service loss, radio access technology downgrades, IMS deregistration, registration flapping, and explicit reject causes—are obscured by routine noise and complicated by multi-SIM interleaving. This paper presents a method that extracts these events into a normalized, per-slot timeline using a ranked RAT transition model, classifies five anomaly types by severity, and does so under an explicit adversarial input model in which log content is treated as untrusted. Design commitments include subscriber-identifier redaction by default via hashed tokens that preserve correlation semantics, terminal escape-injection defense, data minimization, crafted-input resource guards, and SHA-256 integrity stamping of the analyzed bytes. Downgrades toward the 2G family are weighted HIGH as a cell-site-simulator indicator, with the stated boundary that host-side logs cannot confirm radio-frequency conclusions. The method is grounded in field diagnosis of a secondary-profile IMS registration fault on GrapheneOS and is implemented as the open-source tool radio-triage.