Empirical Analysis of Cybersecurity Threat Patterns in Nigerian Telecommunications Networks Using Honeypot Data

Understanding the nature, origin, and targeting patterns of cyberattacks against telecommunications networks is essential for developing effective defense strategies and informing regulatory cybersecurity frameworks. This study empirically analyzes cybersecurity threat patterns in Nigerian telecommunications networks using honeypot sensor data, providing the first locally grounded empirical dataset on attack targeting characteristics in the sector. A distributed honeypot deployment consisting of twelve strategically placed low-interaction honeypot sensors was operated within the network boundaries of two internet service providers in Lagos and Abuja over a nine-month data collection period. Honeypot sensors simulated telecommunications management interfaces including Telnet, SSH, and web-based network management systems. A total of 847,000 attack events were captured, catalogued, and analyzed for attack type, source geography, targeted service, and temporal pattern characteristics. Brute force authentication attacks constituted 62% of all captured events. Scanning for vulnerable Telnet and outdated SSH protocol versions accounted for 28% of events, reflecting exploitation of legacy network device vulnerabilities. Source geography analysis identified traffic originating from Eastern European and East Asian autonomous systems in 71% of traceable events, with local Nigerian source addresses constituting only 4% of attack origins. Attack frequency exhibited distinct daily patterns with peaks between 02:00 and 06:00 WAT, suggesting automated bot-driven campaigns. The empirical dataset provides actionable threat intelligence for Nigerian ISP security operations and informs NCC cybersecurity regulatory development. Keywords: cybersecurity, honeypot, threat analysis, Nigerian ISP, network security.