2009 Fifth International Conference on IT Security Incident Management and IT Forensics最新文献_第2页

From the Computer Incident Taxonomy to a Computer Forensic Examination Taxonomy 从计算机事件分类法到计算机取证检查分类法

2009 Fifth International Conference on IT Security Incident Management and IT Forensics Pub Date : 2009-09-15 DOI: 10.1109/IMF.2009.17

R. Altschaffel, Stefan Kiltz, J. Dittmann

引用次数: 7

Overcast: Forensic Discovery in Cloud Environments 阴天:云环境中的取证发现

2009 Fifth International Conference on IT Security Incident Management and IT Forensics Pub Date : 2009-09-15 DOI: 10.1109/IMF.2009.21

S. Wolthusen

引用次数: 71

Experiences with the NoAH Honeynet Testbed to Detect new Internet Worms 使用NoAH Honeynet测试平台检测新的互联网蠕虫的经验

2009 Fifth International Conference on IT Security Incident Management and IT Forensics Pub Date : 2009-09-15 DOI: 10.1109/IMF.2009.9

Jan Kohlrausch

{"title":"Experiences with the NoAH Honeynet Testbed to Detect new Internet Worms","authors":"Jan Kohlrausch","doi":"10.1109/IMF.2009.9","DOIUrl":"https://doi.org/10.1109/IMF.2009.9","url":null,"abstract":"Recently, major advances have been made in the area of honeypot technologies. These include the development of very accurate and reliable detection methods for unknown attacks targeted at memory corruption vulnerabilities and the design of efficient network architectures. These architectures allow to monitor a large network of IP addresses applying advanced detection methods for zero-day exploits and new Internet worms. Such an advanced architecture and detection method was developed by the NoAH research project funded by the Sixth EU’s Framework Programme for Research and Technological Development. A pilot testbed was set up to demonstrate its effectiveness to detect well-known as well as new attacks on the Internet. While the technical components are well-understood, the interpretation and analysis of the resulting information is to the best of our knowledge still not fully explored by research projects. For the NoAH pilot testbed, a critical test to demonstrate its effectiveness arose with the appearance of the W32.Conficker worm in November 2008. In this paper we present the experimental results of this testbed focusing on the detection and analysis of the W32.Conficker worm which is still widely spread and an ongoing threat to the Internet. In detail, we introduce the detection process starting with the first suspicion of a new Internet worm towards its analysis and capture of malware.","PeriodicalId":370893,"journal":{"name":"2009 Fifth International Conference on IT Security Incident Management and IT Forensics","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125902193","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15

Analysis of Download Accelerator Plus (DAP) for Forensic Artefacts 下载加速器Plus (DAP)对法医文物的分析

2009 Fifth International Conference on IT Security Incident Management and IT Forensics Pub Date : 2009-09-15 DOI: 10.1109/IMF.2009.11

Muhammad Yasin, M. A. Wahla, F. Kausar

引用次数: 13