Further Aspects of Passive DNS Datamining, visualization and alternative implementations
|
|
|
- Angelica Louisa Greer
- 5 years ago
- Views:
Transcription
1 Further Aspects of Passive DNS Datamining, visualization and alternative implementations Sebastien Tricaud (PicViz), Alexandre Dulaunoy (CIRCL.lu), L. Aaron Kaplan (CERT.at), David Durvaux (CERT.be), John Kristoff (Team Cymru) June 19, 2012
2 Disclaimer Passive DNS is a technique to collect only valid answers from authoritative or caching nameservers By its design, privacy is preserved (e.g. no source IP addresses from resolvers are captured 1 ) DNS data collected is only publicly known DNS data The research is done in the sole purpose to detect malicious IP/domains or content to better protect users Passive DNS implementations are subject to local rules 1 Except if an application abuses DNS answers to track back their users. 2 of 26
3 Passive DNS is to DNS ops as NetFlow is to net ops. John Kristoff 3 of 26
4 Passive DNS - how it works 4 of 26
5 What s the purpose? Some examples... 5 of 26
6 Detection of shared compromised web hosting - the enisa.eu case Regularly malicious links are posted on compromised systems What are the other services or domains hosted on the same A/AAAA record? What happens to infected redirect (because the web hosting server is infected)? How Passive DNS can help? 6 of 26
7 EG (Egypt being offline) Discover non resolvable domains using nameserver in Egypt Interesting discovery randomstring.medicpills.ru ( less spam?) BIT.LY case is similar (when Libya was offline) Passive DNS helps to find interdependecies among services 7 of 26
8 Malware infection History of a domain name in conjunction with Netflow records Find shorted lived domain names Get back the A/AAAA records and find infected PCs in your Netflow. Quick win! 8 of 26
9 Passive DNS implementations BFK (F. Weimer a ) passive dns CIRCL pdns-toolkit b CERT.at passive dns c CERT.ee passive dns a Presented at FIRST 2005 b github.com/adulau/pdns-toolkit/ c access upon request CERT.lv passive dns ISC DNSDB a The University of Auckland DNS History Database Project (DHDB) Team Cymru passive dns a 9 of 26
10 Passive DNS design comparison - an ecosystem CIRCL pdns-toolkit CERT.at passive dns datastore Redis PostgreSQL + memcached storage memory hybrid exhaustive - + space efficient ++ + input pcap, dnscap output nmsg open source yes ask 10 of 26
11 Some statistics from the CERT.at Passive DNS of 26
12 Storing Passive DNS - CIRCL.lu perspective Implementing the storage of a Passive DNS can be challenging Starting from standard RDBMS and then moved to a key-value store We learned to hate 2 hard disk drive and to love random access memory Loving memory is great especially when it s now cheap and addressable in 64bits 2 exception only used for data store snapshot 12 of 26
13 Passive DNS + Ranked domains - Where visualization can help Now, we have 50 millions lines of ranked hostname breadworld.com. o-o.resolver.a.b.c.d.5xevqnwsds5zdq34.metricz.\ l.google.com. smtp10.dti.ne.jp of 26
14 Why visualization? Understand big data Find stuff we cannot guess 14 of 26
15 Choosing Parallel Coordinates Display as much dimensions wanted (yes, as many) Display as much data wanted (I mean it!) 15 of 26
16 Interesting patterns 16 of 26
17 Picvizing a CIRCL passive DNS dataset 17 of 26
18 Picviz with subdomains split 18 of 26
19 Reward: highest is youtube 19 of 26
20 Subdomain entropy Only one sub-domain has an entropy 3 >4.8 3 Shannon entropy 20 of 26
21 Subdomain entropy Only one sub-domain has an entropy 4 >4.8 4 Shannon entropy 21 of 26
22 Scatter plot - finding outliers 22 of 26
23 Scatter plot - finding outliers - covert channel? [..] lbl8.mailshell.net t10000.u s [..]-1329.zv6lit-null.zrdtd-1311.zr6tdnull.results.potaroo.net [..] lbl8.mailshell.net 23 of 26
![Searching for Zeus Using the broad Polish CERT regex [a-z0-9]{32,48}\.](/docs-images/84/90624274/images/24-0.jpg "(ru com biz info org net) We get some cool domains: cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com eef795a4eddaf1e7bd79212acc9dde16.")
24 Searching for Zeus Using the broad Polish CERT regex [a-z0-9]{32,48}\.(ru com biz info org net) We get some cool domains: cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com eef795a4eddaf1e7bd79212acc9dde16.net but more important we got a visualization profile to find outliers not matching the regexp 24 of 26
25 Conclusion Passive DNS is an infinite source of security data mining A team of passive DNS is at your services, contact us! (adequate) Visualization is an appropriate way to discover unknown malicious or suspicious services This finally helps CSIRTs to act earlier on the incidents Common output format for different implementations (work in progress) 25 of 26
26 Q&A 26 of 26
Scrutinizing a Country using Passive DNS and Picviz or how to analyze big dataset without loosing your mind
Scrutinizing a Country using Passive DNS and Picviz or how to analyze big dataset without loosing your mind Sebastien Tricaud, Alexandre Dulaunoy March 10, 2012 Disclaimer Passive DNS is a technique to
Passive DNS. Using the DNS for fun and profit. Alexandre Dulaunoy. March 4, Alexandre Dulaunoy Passive DNS
Using the DNS for fun and profit March 4, 2016 Domain Name Space and Structure Domain Name Space and Structure 1/3 The domain name space is structured in a tree. The DNS root zone is at the top and provide
Tracking Evil with Passive DNS
Tracking Evil with Passive DNS Bojan Ždrnja, CISSP, GCIA, GCIH Bojan.Zdrnja@infigo.hr INFIGO IS http://www.infigo.hr Who am I? Senior information security consultant with INFIGO IS (Croatia) Mainly doing
DNSSM: A Large Scale Passive DNS Security Monitoring Framework
samuel.marchal@uni.lu 16/04/12 DNSSM: A Large Scale Passive DNS Security Monitoring Framework Samuel Marchal, Jérôme François, Cynthia Wagner, Radu State, Alexandre Dulaunoy, Thomas Engel, Olivier Festor
Strange Things Found in an Open Resolver Survey
Strange Things Found in an Open Resolver Survey Duane Wessels The Measurement Factory/CAIDA WIDE+CAIDA Workshop #9 January 19, 2008 WIDE+CAIDA 0 The Measurement Factory Open Resolvers Defined: A nameserver
The Void. An Interesting Place For Network Security Monitoring. Alexandre Dulaunoy, CIRCL- TLP:WHITE. 19 November 2013 LORIA Seminar
The Void An Interesting Place For Network Security Monitoring Alexandre Dulaunoy, CIRCL- TLP:WHITE alexandre.dulaunoy@circl.lu 19 November 2013 LORIA Seminar CIRCL, national CERT of Luxembourg CIRCL 1
Redesigning CERT.at s incident handling capabilities cherrypicking and learning from AH and Megatron
Redesigning CERT.at s incident handling capabilities cherrypicking and learning from AH and Megatron L. Aaron Kaplan 2012/04/25 1 Disclaimer / Motivation I am not an AH expert I am not
Computer Security CS 426
Computer Security CS 426 Lecture 34 DNS Security 1 Domain Name System Translate host names to IP addresses E.g., www.google.com 74.125.91.103 Hostnames are human-friendly IP addresses keep changing And
Another Perspective to IP-Darkspace Analysis
Another Perspective to IP-Darkspace Analysis RESTENA - CSIRT Computer Security Incident Response Team Cynthia Wagner, Marc Stiefer, Restena-CSIRT Alexandre Dulaunoy, Gérard Wagener, CIRCL- TLP:AMBER info@circl.lu,
Introduction to Honeypot Technologies
Introduction to Honeypot Technologies A Tool For Improving Network Forensic Analysis Alexandre Dulaunoy alexandre.dulaunoy@circl.lu January 13, 2012 Introduction and Source of Honeynet Research With the
An Introduction to Incident Detection and Response Memory Forensic Analysis
An Introduction to Incident Detection and Response Memory Forensic Analysis Alexandre Dulaunoy - TLP:WHITE a@foo.be February 11, 2016 An overview to incident response Detection Analysis Containment Investigation
2018 Edition. Security and Compliance for Office 365
2018 Edition Security and Compliance for Office 365 [Proofpoint has] given us our time back to focus on the really evil stuff. CISO, Global 500 Manufacturer Like millions of businesses around the world,
L. Aaron Kaplan
V I S U A L I Z A T I O N F O R I T - S E C U R I T Y L. Aaron Kaplan (kaplan@cert.at) http://cert.at OVERVIEW Motivation Target Group 5 Minutes of design background for techies Tools DNSviz and Flows
Avoiding Information Overload: Automated Data Processing with n6
Avoiding Information Overload: Automated Data Processing with n6 Paweł Pawliński pawel.pawlinski@cert.pl 26th annual FIRST conference Boston, June 23rd 2014 Who we are part of national CERT for Poland
Wireshark. Why we need to capture packet & how it s related to security? 6/19/ June 2018 PacNOG 22, Honiara, Solomon Islands Supported by:
Wireshark 25-29 June 2018 PacNOG 22, Honiara, Solomon Islands Supported by: Issue Date: Revision: 1 Why we need to capture packet & how it s related to security? 1 tcpdump Definition tcpdump is a utility
Automating Security Response based on Internet Reputation
Add Your Logo here Do not use master Automating Security Response based on Internet Reputation IP and DNS Reputation for the IPS Platform Anthony Supinski Senior Systems Engineer www.h3cnetworks.com www.3com.com
Incident Scale
SESSION ID: SOP-T07 Incident Response @ Scale Salah Altokhais Incident Response Consultant National Cyber Security Center (NCSC),KSA @salah.altokhais Khalid Alsuwaiyel Incident Response Specialist National
Replication. Feb 10, 2016 CPSC 416
Replication Feb 10, 2016 CPSC 416 How d we get here? Failures & single systems; fault tolerance techniques added redundancy (ECC memory, RAID, etc.) Conceptually, ECC & RAID both put a master in front
Tanium Endpoint Detection and Response. (ISC)² East Bay Chapter Training Day July 13, 2018
Tanium Endpoint Detection and Response (ISC)² East Bay Chapter Training Day July 13, 2018 $> WhoamI 11 Years of Security Experience Multiple Verticals (Technology, Industrial, Healthcare, Biotech) 9 Years
Threat Hunting in Modern Networks. David Biser
Threat Hunting in Modern Networks David Biser What is Threat Hunting? The act of aggressively pursuing and eliminating cyber adversaries as early as possible in the Cyber Kill Chain. Why Perform Threat
OpenDNS DNS Database Client Library Documentation
OpenDNS DNS Database Client Library Documentation Release 0.1 Frank Denis October 21, 2016 Contents 1 Installation 1 2 Example 3 3 Parallel requests 5 4 Setup 7 5 Note on certificates format 9 6 Operations
(Botnets and Malware) The Zbot attack. Group 7: Andrew Mishoe David Colvin Hubert Liu George Chen John Marshall Buck Scharfnorth
(Botnets and Malware) The Zbot attack Group 7: Andrew Mishoe David Colvin Hubert Liu George Chen John Marshall Buck Scharfnorth What Happened? Type of Attack Botnet - refers to group of compromised computers
TOP TEN DNS ATTACKS PROTECTING YOUR ORGANIZATION AGAINST TODAY S FAST-GROWING THREATS
TOP TEN DNS ATTACKS PROTECTING YOUR ORGANIZATION AGAINST TODAY S FAST-GROWING THREATS 1 Introduction Your data and infrastructure are at the heart of your business. Your employees, business partners, and
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM OVERVIEW The Verizon 2016 Data Breach Investigations Report highlights that attackers are regularly outpacing the defenders.
DNS Firewall with Response Policy Zone. Suman Kumar Saha bdcert Amber IT Limited
DNS Firewall with Response Policy Zone Suman Kumar Saha bdcert suman@bdcert.org Amber IT Limited suman@amberit.com.bd DNS Response Policy Zone(RPZ) as Firewall RPZ allows a recursive server to control
DPU TDC 463. Scanning, Probing, and Surveying for Internet Hosts and Services. TDC463 Fall 2017 John Kristoff DePaul University 1
DPU TDC 463 Scanning, Probing, and Surveying for Internet Hosts and Services TDC463 Fall 2017 John Kristoff DePaul University 1 The Probing Challenge To quickly, periodically, safely and accurately discover
MISP Workbench - Manage your very own Cyber Threat Intelligence tool MISP - Malware Information Sharing Platform & Threat Sharing
MISP Workbench - Manage your very own Cyber Threat Intelligence tool MISP - Malware Information Sharing Platform & Threat Sharing Alexandre Dulaunoy Andras Iklody Raphaël Vinot TLP:WHITE http://www.misp-project.org/
Comodo cwatch Web Security Software Version 2.9
rat Comodo cwatch Web Security Software Version 2.9 Quick Start Guide Guide Version 2.9.032318 Comodo Security Solutions 1255 Broad Street Clifton, NJ 07013 Comodo cwatch Web Security - Quick Start Guide
An Eye on the Storm: Inside the Storm Epidemic. Josh Ballard Network Security Analyst Kansas State University
An Eye on the Storm: Inside the Storm Epidemic Josh Ballard Network Security Analyst Kansas State University bal@k-state.edu Contents The Headlines Peer-to-peer network So just how big is this thing? How
50331 Windows Client, Enterprise Desktop Support Technician
Course This course provides students with the knowledge and skills needed to isolate, document and resolve problems on Windows Desktops in a corporate domain. The material is geared towards corporate IT
Proactive Approach to Cyber Security
Proactive roach to Cyber Security Jeffrey Neo Sales Director HP Enterprise Security Products Customers struggle to manage the security challenge Today, security is a board-level agenda item 2 Trends driving
Scaling Pinterest. Marty Weiner Level 83 Interwebz Geek
Scaling Pinterest Marty Weiner Level 83 Interwebz Geek Evolution Growth March 2010 Page views per day RackSpace 1 small Web Engine 1 small MySQL DB 1 Engineer + 2 Founders Mar 2010 Jan 2011 Jan 2012 May
Security Aspects Control Rationale Best Practices Self-Assessment (Click all that applicable) 1. Security Policy and Security Management
Seven Habits of Cyber Security for SMEs Security Aspects Control Rationale Best Practices Self-Assessment (Click all that applicable) 1. Security Policy and Security Management Security Policy is an important
Building an Efficient Incident Response Process Using Threat Intelligence A Global Enterprise Perspective
Building an Efficient Incident Response Process Using Threat Intelligence A Global Enterprise Perspective Thomas Schreck Borderless Cyber Europe 2016 Principal Engineer at Director of FIRST.org Seite 2
Windows 7, Enterprise Desktop Support Technician
Windows 7, Enterprise Desktop Support Technician Course 50331D; 5 days, Instructor-led Course Description This five-day instructor-led course provides students with the knowledge and skills needed to isolate,
Croatian National CERT ACDC project Darko Perhoc, Head of National CERT CISSP, CEH, CCNP Security R&S,CCDP
Croatian National CERT ACDC project Darko Perhoc, Head of National CERT CISSP, CEH, CCNP Security R&S,CCDP Croatian National CERT (HR-CERT) mission: Promoting and preserving information security of public
Security and Compliance for Office 365
Security and Compliance for Office 365 [Proofpoint has] given us our time back to focus on the really evil stuff. CISO, Global 500 Manufacturer Like millions of businesses around the world, you may be
IP Addresses. An IPv4 address looks like this
DNS IP Addresses Domain Names Domain Name System The Domain Name Hierarchy Components of a Domain Name How DNS Works DNS Name Resolution Configuring DNS on it20 IP Addresses For a computer to talk to the
AIL Framework for Analysis of Information Leaks From a CSIRT use-case towards a generic analysis open source software
AIL Framework for Analysis of Information Leaks From a CSIRT use-case towards a generic analysis open source software Team CIRCL - TLP:WHITE info@circl.lu FIRST 2017 Leaks and CSIRT day-to-day operations
Using Internet Data Sets to Understand Digital Threats
Using Internet Data Sets to Understand Digital Threats CONTENTS EXECUTIVE SUMMARY...1 ACTIONS LEAVE BREADCRUMBS. MAKE SURE TO FOLLOW THEM...2 INFRASTRUCTURE CHAINING...3 INTERNET DATA SETS...3 PASSIVE
Advanced Threat Intelligence to Detect Advanced Malware Jim Deerman
Advanced Threat Intelligence to Detect Advanced Malware Jim Deerman jdeerman@isc8.com Safe Harbor Statement All statements included or incorporated by reference in these slides, other than statements or
Port Mirroring in CounterACT. CounterACT Technical Note
Table of Contents About Port Mirroring and the Packet Engine... 3 Information Based on Specific Protocols... 4 ARP... 4 DHCP... 5 HTTP... 6 NetBIOS... 7 TCP/UDP... 7 Endpoint Lifecycle... 8 Active Endpoint
Reference Incident Classification Taxonomy Task Force Status and Way Forward JANUARY European Union Agency For Network and Information Security
Reference Incident Classification Taxonomy Task Force Status and Way Forward JANUARY 2018 www.enisa.europa.eu European Union Agency For Network and Information Security About ENISA The European Union Agency
Technical Brief: Domain Risk Score Proactively uncover threats using DNS and data science
Technical Brief: Domain Risk Score Proactively uncover threats using DNS and data science 310 Million + Current Domain Names 11 Billion+ Historical Domain Profiles 5 Million+ New Domain Profiles Daily
The Void. An Interesting Place For Network Security Monitoring. Alexandre Dulaunoy, CIRCL- TLP:WHITE. November 13,
The Void An Interesting Place For Network Security Monitoring Alexandre Dulaunoy, CIRCL- TLP:WHITE alexandre.dulaunoy@circl.lu November 13, 2014 CIRCL, national CERT of Luxembourg CIRCL 1 is composed of
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers How do you attack the DNS? A typical DNS query
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS WHITE PAPER INTRODUCTION BANKS ARE A COMMON TARGET FOR CYBER CRIMINALS AND OVER THE LAST YEAR, FIREEYE HAS BEEN HELPING CUSTOMERS RESPOND
Analyzing Huge Data for Suspicious Traffic. Christian Landström, Airbus DS
Analyzing Huge Data for Suspicious Traffic Christian Landström, Airbus DS Topics - Overview on security infrastructure - Strategies for network defense - A look at malicious traffic incl. Demos - How Wireshark
DNS Cache Poisoning Looking at CERT VU#800113
DNS Cache Poisoning Looking at CERT VU#800113 Nadhem J. AlFardan Consulting Systems Engineer Cisco Systems ANOTHER BORING DNS ISSUE Agenda DNS Poisoning - Introduction Looking at DNS Insufficient Socket
Next Generation Endpoint Security Confused?
SESSION ID: CEM-W06 Next Generation Endpoint Security Confused? Greg Day VP & Chief Security Officer, EMEA Palo Alto Networks @GreDaySecurity Brief Intro Questions we will answer Do I need a new (NG) endpoint
Standard Categories for Incident Response (definitions) V2.1. Standard Categories for Incident Response Teams. Definitions V2.1.
Standard Categories for Incident Response Teams Definitions V2.1 February 2018 Standard Categories for Incident Response (definitions) V2.1 1 Introduction This document outlines categories that Incident
Windows Client, Enterprise Desktop Support Technician
Course 50331D: Windows Client, Enterprise Desktop Support Technician Page 1 of 11 Windows Client, Enterprise Desktop Support Technician Course 50331D: 3 days; Instructor-Led Introduction (Updated for Windows
Smart Protection Network. Raimund Genes, CTO
Smart Protection Network Raimund Genes, CTO Overwhelmed by Volume of New Threats New unique samples added to AV-Test's malware repository (2000-2010) 20.000.000 18.000.000 16.000.000 14.000.000 12.000.000
CYBERSECURITY RISK LOWERING CHECKLIST
CYBERSECURITY RISK LOWERING CHECKLIST The risks from cybersecurity attacks, whether external or internal, continue to grow. Leaders must make thoughtful and informed decisions as to the level of risk they
Infoblox Dossier User Guide
Infoblox Dossier User Guide 2017 Infoblox Inc. All rights reserved. ActiveTrust Platform Dossier and TIDE - June 2017 Page 1 of 16 1. Overview of Dossier... 3 2. Prerequisites... 3 3. Access to the Dossier
This time. Digging into. Networking. Protocols. Naming DNS & DHCP
This time Digging into Networking Protocols Naming DNS & DHCP Naming IP addresses allow global connectivity But they re pretty useless for humans! Can t be expected to pick their own IP address Can t be
Security Trend of New Computing Era
Security Trend of New Computing Era Presented by Roland Cheung HKCERT Agenda Security Threat Overview Introduction of Botnet Impact of Botnet Fight Back Botnet Security Protection Scheme Security Threat
Cybersecurity in Salt Lake City
Cybersecurity in Salt Lake City Dr. Brent Kirkpatrick November 30, 2016 c 2016 Intrepid Net Computing Intrepid Net Computing www.intrepidnetcomputing.com bbkirk@intrepidnetcomputing.com 1 Abstract Using
SPAM Malware s Super Highway. How To Protect Yourself Against Malicious s 1
SPAM Malware s Super Highway How To Protect Yourself Against Malicious Emails 1 What The Good Guys Are Up Against According to Kaspersky Lab: The decline in SPAM emails over the past few years has reversed
Security in AI. Alex Healing Senior Research Manager BT Applied Research. British Telecommunications plc 2019
Security in AI Alex Healing Senior Research Manager BT Applied Research 1 AI and Security AI and Security 2 3 4 Saturn: intelligent interactive data analytics Give the users the control to do what they
Using Passive DNS. 2nd IIA/ISACA Hacking Conference. October 27th, Alan Clegg Farsight Security, Inc /
Using Passive DNS To uncover Network and Server Parasites 2nd IIA/ISACA Hacking Conference October 27th, 2015 Alan Clegg Farsight Security, Inc alan@clegg.com / clegg@fsi.io 919-355-8851 Using Passive
Network Discovery Policies
The following topics describe how to create, configure, and manage network discovery policies: Overview:, page 1 Network Discovery Customization, page 2 Network Discovery Rules, page 3 Configuring Advanced
APWG Global Phishing Survey 2H2010
APWG Global Phishing Survey 2H2010 Rod Rasmussen Greg Aaron June 21, 2011 Goals Study domain names and URLs to: Provide a consistent benchmark for scope of phishing problems worldwide Understand what phishers
Malicious traffic detection system. Miroslav Stampar @stamparm)
Malicious traffic detection system Miroslav Stampar (mstampar@zsis.hr; miroslav@sqlmap.org; @stamparm) Project motivation Idea of a system that would produce less noise by condensing numerous events into
Piero DePaoli, Director, Product Marketing Scott Sawoya, Senior Manager, Product Management. SR B19: Symantec Endpoint Protection 12 Customer Panel
SR B19: Symantec Endpoint Protection 12 Customer Panel Piero DePaoli, Director, Product Marketing Scott Sawoya, Senior Manager, Product Management 1 Panelists Jeff Marsh Christian Sosa David Nguyen Presentation
Course Outline. CCNA Cyber Ops SECOPS Official Cert Guide (Course & Labs)
Course Outline CCNA Cyber Ops SECOPS 210-255 Official Cert Guide 23 Jul 2018 Contents 1. Course Objective 2. Pre-Assessment 3. Exercises, Quizzes, Flashcards & Glossary Number of Questions 4. Expert Instructor-Led
Keeping Your PC Safe. Tips on Safe Computing from Doug Copley
Keeping Your PC Safe Tips on Safe Computing from Doug Copley Don t be an Administrator Administrator is an account that can do ANYTHING on the PC Most computers start with 1 account with administrator
Where s my DNS? Sara Dickinson IDS 2. Where s my DNS?
Sara Dickinson sara@sinodun.com Stub to recursive The DNS protocol is evolving DoT: DNS-over-TLS DoH: DNS-over-HTTPS (WIP) DoT RFC7858 standard May 2016 Implemented to-date in standard open source DNS
DISTRIBUTED SYSTEMS [COMP9243] Lecture 8a: Cloud Computing WHAT IS CLOUD COMPUTING? 2. Slide 3. Slide 1. Why is it called Cloud?
![DISTRIBUTED SYSTEMS [COMP9243] Lecture 8a: Cloud Computing WHAT IS CLOUD COMPUTING? 2. Slide 3. Slide 1. Why is it called Cloud?](/thumbs/78/77201529.jpg "DISTRIBUTED SYSTEMS [COMP9243] Lecture 8a: Cloud Computing WHAT IS CLOUD COMPUTING? 2. Slide 3. Slide 1. Why is it called Cloud?")
DISTRIBUTED SYSTEMS [COMP9243] Lecture 8a: Cloud Computing Slide 1 Slide 3 ➀ What is Cloud Computing? ➁ X as a Service ➂ Key Challenges ➃ Developing for the Cloud Why is it called Cloud? services provided
An Update on Anomalous DNS Behavior
An Update on Anomalous DNS Behavior Duane Wessels, and CAIDA wessels@measurement-factory October 23 Motivation Why are root servers getting slammed? Are caching/forwarding DNS servers doing the right thing?
RIPE Labs. Operators Tools, Ideas and Analysis. Mirjam Kühne, RIPE NCC. RIPE Network Coordination Centre. IETF 78 - Juy 2010.
RIPE Labs Operators Tools, Ideas and Analysis, RIPE NCC 1 What is RIPE Labs? It is a web site, but more importantly: A platform and a tool for the community You can Test and evaluate new tools and prototypes
Mechanisms for Database Intrusion Detection and Response. Michael Sintim - Koree SE 521 March 6, 2013.
Mechanisms for Database Intrusion Detection and Response Michael Sintim - Koree SE 521 March 6, 2013. Article Title: Mechanisms for Database Intrusion Detection and Response Authors: Ashish Kamra, Elisa
Electrical Engineering Department EE 400, Experiment # 4 IP Addressing and Subnetting
Electrical Engineering Department EE 400, Experiment # 4 IP Addressing and Subnetting Objectives: After this experiment, the students should be able to configure for networking, assign IP address, and
Automated Response in Cyber Security SOC with Actionable Threat Intelligence
Automated Response in Cyber Security SOC with Actionable Threat Intelligence while its biggest weakness is lack of visibility: SOCs still can t detect previously unknown threats, which is a consistent
Data Sources for Cyber Security Research
Data Sources for Cyber Security Research Melissa Turcotte mturcotte@lanl.gov Advanced Research in Cyber Systems, Los Alamos National Laboratory 14 June 2018 Background Advanced Research in Cyber Systems,
Introduction to File Structures
1 Introduction to File Structures Introduction to File Organization Data processing from a computer science perspective: Storage of data Organization of data Access to data This will be built on your knowledge
A Sampling of Internetwork Security Issues Involving IPv6
A Sampling of Internetwork Security Issues Involving IPv6 John Kristoff jtk@cymru.com DPU IPv6 Day 2012-10-16 John Kristoff Team Cymru 1 Agenda diff -u ipv4 ipv6 head What is the netsec community working
Threat Trend, Intelligence and Response Anthony LAI Director, Knownsec Hong Kong
Knownsec Hong Kong Threat Trend, Intelligence and Response Anthony LAI Director, Knownsec Hong Kong About Knownsec We set up Knownsec Hong Kong since 2012. Knownsec HQ in Beijing is set up since 2007 Invested
The Domain Name System
The Domain Name System History of DNS Before DNS ARPAnet HOSTS.txt contains all the hosts information Maintained by SRI s Network Information Center In SRI-NIC host Problems: Not scalable! Traffic and
Security Whitepaper. DNS Resource Exhaustion
DNS Resource Exhaustion Arlyn Johns October, 2014 DNS is Emerging as a Desirable Target for Malicious Actors The current threat landscape is complex, rapidly expanding and advancing in sophistication.
Deploy the ExtraHop Discover 3100, 6100, 8100, or 9100 Appliances
Deploy the ExtraHop Discover 3100, 6100, 8100, or 9100 s Published: 2017-12-29 This guide explains how to install the rack-mounted EDA 3100, EDA 6100, EDA 8100, and EDA 9100 ExtraHop Discover appliances.
n Given a scenario, analyze and interpret output from n A SPAN has the ability to copy network traffic passing n Capacity planning for traffic
Chapter Objectives n Understand how to use appropriate software tools to assess the security posture of an organization Chapter #7: Technologies and Tools n Given a scenario, analyze and interpret output
Cisco Cyber Range. Paul Qiu Senior Solutions Architect June 2016
Cisco Cyber Range Paul Qiu Senior Solutions Architect June 2016 What I hear, I forget What I see, I remember What I do, I understand ~ Confucius Agenda Agenda Cyber Range Highlights Cyber Range Overview
Choose Your Battles How To Fight The Right Wars. Eyal Paz, Security Researcher
Choose Your Battles How To Fight The Right Wars Eyal Paz, Security Researcher whoami Security Researcher at Check Point B.Sc. in Software Engineering, studying towards M.Sc. in Computer Science Information
Breaches and Remediation
Breaches and Remediation Ramona Oliver US Department of Labor Personally Identifiable Information Personally Identifiable Information (PII): Any information about an individual maintained by an agency,
Intrusion Attempt Who's Knocking Your Door
10 Intrusion Attempt Who's Knocking Your Door By Kilausuria binti Abdullah Introduction: An intrusion attempt is a potential for a deliberate unauthorized attempt to enter either a computer, system or
Case studies in global criminal attacks: McColo & CheckFreea
Case studies in global criminal attacks: McColo & CheckFreea Rod Rasmussen, President & CTO Internet Identity, APWG Industry Liaison E Crime and Abuse of the DNS Forum: Session 2. Criminal Attacks & Abuse
Operations, Analysis and Research Center for the Internet Co-ordination centre to protect Global DNS infrastructure Trusted, neutral environment for
Recent DNS Events and OARC Activities Keith Mitchell OARC Programme Manager Internet Systems Consortium RIPE54 DNS WG Tallinn, Estonia May 2007 What is OARC? Operations, Analysis and Research Center for
Network Security Issues and New Challenges
Network Security Issues and New Challenges Brijesh Kumar, Ph.D. Princeton Jct, NJ 08550 Brijesh_kumar@hotmail.com A talk delivered on 11/05/2008 Contents Overview The problem Historical Perspective Software
The evolution of malevolence
Detection of spam hosts and spam bots using network traffic modeling Anestis Karasaridis Willa K. Ehrlich, Danielle Liu, David Hoeflin 4/27/2010. All rights reserved. AT&T and the AT&T logo are trademarks
SYMANTEC DATA CENTER SECURITY
SYMANTEC DATA CENTER SECURITY SYMANTEC UNIFIED SECURITY STRATEGY Users Cyber Security Services Monitoring, Incident Response, Simulation, Adversary Threat Intelligence Data Threat Protection Information
DNSSM: A Large Scale Passive DNS Security Monitoring Framework
DNSSM: A Large Scale Passive DNS Security Monitoring Framework Samuel Marchal, Jérôme François, Cynthia Wagner, Radu State, Alexandre Dulaunoy, Thomas Engel, Olivier Festor To cite this version: Samuel
Seceon s Open Threat Management software
Seceon s Open Threat Management software Seceon s Open Threat Management software (OTM), is a cyber-security advanced threat management platform that visualizes, detects, and eliminates threats in real
A versatile platform for DNS metrics
A versatile platform for DNS metrics Stéphane Bortzmeyer AFNIC bortzmeyer@nic.fr OARC - Atlanta - 2 february 2009 1 A versatile platform for DNS metrics Where are we in the talk? 1 General presentation
BIG-IP Access Policy Manager : Secure Web Gateway. Version 13.0
BIG-IP Access Policy Manager : Secure Web Gateway Version 13.0 Table of Contents Table of Contents BIG-IP APM Secure Web Gateway Overview...9 About APM Secure Web Gateway... 9 About APM benefits for web
Computer Visions Course Outline
www.compvisions.com 16 Corporate Woods Blvd. Albany, NY 12211 Computer Visions Course Outline Get What You Want We offer highly customizable group training courses: desktop applications, web development,
BetterCrypto org Applied Crypto Hardening
BetterCrypto org Applied Crypto Hardening David Durvaux Brussels, 12 th June 2014 Why better crypto? But of course... It is not only the NSA, who intercepts Other nations now have a blueprint (thanks
Cisco Protects Internal Infrastructure from Web-Based Threats
Cisco Protects Internal Infrastructure from Web-Based Threats / Security / IronPort S670 Web Security Appliance: Cisco is working to become a borderless enterprise, where authorized employees, partners,
Network Security Detection With Data Analytics (PREDATOR)
CIS-601 Graduate Seminar Network Security Detection With Data Analytics (PREDATOR) PRESENTED BY :RAJAN SHARMA CSU ID: 2659829 GUIDED BY : Dr. SUNNIE CHUNG Overview Introduction Feature Extraction and Machine
Pope: Infrastructure for DNS Scanning
: Infrastructure for DNS Scanning 1 David Dagon 1 Luo Daniel Xiapu 1 1 {manos@cc,dagon@cc,xluo7@mail}.gatech.edu Georgia Institute of Technology Information Security Center Atlanta, Georgia OARC 2009 -