2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing最新文献

nicter: An Incident Analysis System Toward Binding Network Monitoring with Malware Analysis nicter:面向绑定网络监控与恶意软件分析的事件分析系统

2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing Pub Date : 2008-04-21 DOI: 10.1109/WISTDCS.2008.14

D. Inoue, M. Eto, K. Yoshioka, S. Baba, K. Suzuki, J. Nakazato, K. Ohtaka, K. Nakao

引用次数: 53

Cooperation of Intelligent Honeypots to Detect Unknown Malicious Codes 智能蜜罐协同检测未知恶意代码

2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing Pub Date : 2008-04-21 DOI: 10.1109/WISTDCS.2008.10

Jungsuk Song, H. Takakura, Y. Okabe

引用次数: 38

The Leurre.com Project: Collecting Internet Threats Information Using a Worldwide Distributed Honeynet Leurre.com项目:使用全球分布式蜜网收集互联网威胁信息

2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing Pub Date : 2008-04-21 DOI: 10.1109/WISTDCS.2008.8

Corrado Leita, V. Pham, Olivier Thonnard, E. S. Ramírez, F. Pouget, E. Kirda, M. Dacier

{"title":"The Leurre.com Project: Collecting Internet Threats Information Using a Worldwide Distributed Honeynet","authors":"Corrado Leita, V. Pham, Olivier Thonnard, E. S. Ramírez, F. Pouget, E. Kirda, M. Dacier","doi":"10.1109/WISTDCS.2008.8","DOIUrl":"https://doi.org/10.1109/WISTDCS.2008.8","url":null,"abstract":"This paper aims at presenting in some depth the Leurre.com project and its data collection infrastructure. Launched in 2003 by the Institut Eurecom, this project is based on a worldwide distributed system of honeypots running in more than 30 different countries. The main objective of the project is to get a more realistic picture of certain classes of threats happening on the Internet, by collecting unbiased quantitative data in a long-term perspective. In the first phase of the project, the data collection infrastructure relied solely on low-interaction sensors based on Honeyd to collect unsolicited traffic on the Internet. Recently, a second phase of the project was started with the deployment of medium-interaction honeypots based on the ScriptGen technology, in order to enrich the network conversations with the attackers. All network traces captured on the platforms are automatically uploaded into a centralized database accessible by the partners via a convenient interface. The collected traffic is also enriched with a set of contextual information (e.g. geographical localization and reverse DNS lookups). This paper presents this complex data collection infrastructure, and offers some insight into the structure of the central data repository. The data access interface has been developed to facilitate the analysis of today's Internet threats, for example by means of data mining tools. Some concrete examples are presented to illustrate the richness and the power of this data access interface. By doing so, we hope to encourage other researchers to share with us their knowledge and data sets, to complement or enhance our ongoing analysis efforts, with the ultimate goal of better understanding Internet threats.","PeriodicalId":142886,"journal":{"name":"2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing","volume":"133 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-04-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133112715","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 46

Techcrafters and Makecrafters: A Comparison of Two Populations of Hackers Techcrafters和makecters:两类黑客群体的比较

2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing Pub Date : 2008-04-21 DOI: 10.1109/WISTDCS.2008.9

T. Holt, M. Kilger

引用次数: 38

The Honeynet Project: Data Collection Tools, Infrastructure, Archives and Analysis 蜜网项目:数据收集工具、基础设施、档案和分析

2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing Pub Date : 2008-04-21 DOI: 10.1109/WISTDCS.2008.11

David Watson, Jamie Riden

引用次数: 46

Honey@home: A New Approach to Large-Scale Threat Monitoring Honey@home:大规模威胁监测的新方法

2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing Pub Date : 2007-11-02 DOI: 10.1145/1314389.1314398

S. Antonatos, M. Athanatos, G. Kondaxis, J. Velegrakis, N. Hatzibodozis, S. Ioannidis, E. Markatos

{"title":"Honey@home: A New Approach to Large-Scale Threat Monitoring","authors":"S. Antonatos, M. Athanatos, G. Kondaxis, J. Velegrakis, N. Hatzibodozis, S. Ioannidis, E. Markatos","doi":"10.1145/1314389.1314398","DOIUrl":"https://doi.org/10.1145/1314389.1314398","url":null,"abstract":"Honeypots have been proven to be very useful for accurately detecting attacks, including zero-day threats, at a reasonable cost and with zero false positives. However, there are two pressing problems with existing approaches. The first problem is that timely detection requires deployment of honeypots in a large fraction of the network address space, which many organizations or ISPs cannot afford. The second problem is that attackers are evolving, and it has been shown that it is not difficult for them to identify honeypots and develop blacklists to avoid them when launching a new attack. In response to these problems, we propose a new architecture that enables large-scale deployment at low cost, while making it harder for attackers to maintain accurate blacklists. The Honey@home architecture relies on communities of regular users installing a lightweight honeypot that monitors unused IP addresses and ports. Since it does not require the static allocation of valuable chunks of network address space, and considering the success of other community-based approaches such as seti@home and folding@home, our approach is well-suited for creating a large-scale honeypot infrastructure at low cost. Since participation in the system is dynamic as users come and go, it becomes harder for attackers to maintain accurate blacklists. In this paper we discuss the current design of the Honey@home architecture, a preliminary implementation and describe the design issues that we faced especially with respect to infrastructure robustness, the challenges we have to deal with and the effectiveness of our approach.","PeriodicalId":142886,"journal":{"name":"2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing","volume":"80 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133324148","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 34