Honeypot traces forensics by means of attack event identification