Peering into Botnets via Fast Flux Enumeration: The ATLAS Experience. Jose Nazario, Ph.D. FIRST 2008 NSM-SIG Vancouver
|
|
|
- Job Pierce
- 6 years ago
- Views:
Transcription
1 Peering into Botnets via Fast Flux Enumeration: The ATLAS Experience Jose Nazario, Ph.D. FIRST 2008 NSM-SIG Vancouver
2 Project o ATLAS - global Internet monitoring o Fast flux - used to discover bots/infected hosts Active probing o Added to ATLAS Q Page 2
3 Operational Uses o Tracking botnets o Storm, Rock phishing, etc Page 3
4 Observations o Storm - sometimes used o Rock phish - used heavily o Other spam, phishing - used often o Malcode distribution - Spring 08 SQL injection Page 4
5 Botnet Visibility o Botnets need good server management when using fast flux o Let them do the host qualifications o Only globally unique IP addresses o Other factors - uptime, speed - vary Page 5
6 Botnet Visibility via DNS Mining ~10%? Page 6
7 24 Hours of Fast Flux Bots Page 7
8 Calling it Fast Flux o Heuristics o Based on discussions with R. Danford, T. Holz o Using Danford s heuristics as base Page 8
9 Qualifying Fast Flux Domain Names o Domain name - A record query o Short TTL - under 900 sec o TTL < 2 treated specially, aggressively o More than 5 IPs o IP list has average distance > /16 More than 8 IPs? Score is +2 o IP list has more than 2 ASNs represented o Page 9
10 Qualifying Fast Flux Domain Names ;; ANSWER SECTION: clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A clickbnr.com. 600 IN A TTL < 900sec - TTL < 2sec treated special Page 10 More than 5 IPs in RRset Avg. Distance > /16 -More than 8 IPs? +2 More than 2 ASNs
11 Qualifying Fast Flux Domain Names (cont) o Domain name NS query o NS results average distance > /16 o More than 3 NS entries o SOA query o Minimum retry < 15min Page 11
12 Qualifying Fast Flux Domains (cont) ;; ANSWER SECTION: clickbnr.com. 600 IN NS ns6.clickbnr.com. clickbnr.com. 600 IN NS ns8.clickbnr.com. clickbnr.com. 600 IN NS ns4.clickbnr.com. clickbnr.com. 600 IN NS ns2.clickbnr.com. clickbnr.com. 600 IN NS ns10.clickbnr.com. clickbnr.com. 600 IN NS ns9.clickbnr.com. clickbnr.com. 600 IN NS ns11.clickbnr.com. clickbnr.com. 600 IN NS ns7.clickbnr.com. clickbnr.com. 600 IN NS ns5.clickbnr.com. clickbnr.com. 600 IN NS ns1.clickbnr.com. clickbnr.com. 600 IN NS ns3.clickbnr.com. ;; ADDITIONAL SECTION: ns5.clickbnr.com. 600 IN A ns6.clickbnr.com. 600 IN A ns7.clickbnr.com. 600 IN A ns8.clickbnr.com. 600 IN A ns9.clickbnr.com. 600 IN A ns10.clickbnr.com. 600 IN A ns11.clickbnr.com. 600 IN A More than 3 NS entries Avg. Distance > /16 Page 12
13 Qualifying Fast Flux Domain Names (cont) o Each attribute is 1 pt o If more than 4 points - fluxy o Exclude whitelist behaviors o Confirm with SURBL If not, just suspect Page 13
14 Benign Fast Flux Symptoms ;; ANSWER SECTION: database.clamav.net. 60 IN CNAME db.local.clamav.net. db.local.clamav.net IN CNAME db.us.rr.clamav.net. db.us.rr.clamav.net. 900 IN A db.us.rr.clamav.net. 900 IN A db.us.rr.clamav.net. 900 IN A db.us.rr.clamav.net. 900 IN A ;; AUTHORITY SECTION: rr.clamav.net IN NS ns3.clamav.net. rr.clamav.net IN NS ns7.clamav.net. rr.clamav.net IN NS ns5.clamav.net. rr.clamav.net IN NS ns2.clamav.net. rr.clamav.net IN NS ns6.clamav.net. rr.clamav.net IN NS ns1.clamav.net. rr.clamav.net IN NS ns4.clamav.net. ;; ADDITIONAL SECTION: ns2.clamav.net IN A ns4.clamav.net IN A ns5.clamav.net IN A ns5.clamav.net IN AAAA 2001:1418:13:1::1 ns6.clamav.net IN A ns7.clamav.net IN A ns1.clamav.net IN A Page 14
15 Code and Components o Python o High speed DNS query engine Libevent - evdns GNU adns o ATLAS data stores Time series data Geo-lookups of IPs Query front end Page 15
16 ATLAS Querying o Every TTL+1, run queries o Store results o Dead detection After 1 day of failure to grow, prune from list 0 IPs (eg pulled domain) or a parked domain name Page 16
17 Discovering Domains o Implemented qualifying domain name screening tool o Data sources Spam feed DNS names from malcode analysis Malware, spam domains lists o Added manually Page 17
18 Assessing Domain Discovery Methods o Looked at interval between domain name registration date and first seen actively fluxing o Average interval: 28.8 days o Minimum 0.4 days o Maximum days o Possible reasons ATLAS visibility (e.g. weak spam feed) Sleeper domains Page 18
19 Global Fast Flux Trends o Domains in use by one botnet o Simple set-based approach to peek Net1 Net2 Net1 Net2 Near 0: no common members Near 1: same botnet Page 19
20 Active Fast Flux Botnets o 428 active domains analyzed May 30, hour snapshot o Results 26 active and distinct clusters Indicates 26 active botnets using fast flux techniques Some failures to cluster Page 20
21 Botnet Purposes o Based on post-facto analysis of 26 clusters 1 Casino 1 Enlargement 4 Malware 10 Pharmacy 13 Phishing Data assistance from CastleCops, PhishTank Some are used for multiple purposes Page 21
22 Multiple infections? Partial overlaps? Partial advertisements? Based on 24h snapshot, June Page 22
23 6 Months of Data o Starting with our ATLAS fast flux tracking o Data: Jan 18 - June 4, 2008 o 912 domains monitored Page 23
24 Increasingly Global Registrar Problem o gtlds used by fast flux domains Broader distribution than found in Holz et al, 2007 Page 24
25 Lifetimes o Average: 18.5 days o Longest 60 days+ (ibank-halifax.com) 59 days+ (armsummer.com) 57 days+ (croptriangle.com) Based on dates of first to last tracking Page 25
26 Sizes o Average size: 2683 IPs (cumulative) o Largest nets: ibank-halifax.com, 100,379 IPs armsummer.com, 14,233 IPs boardhour.com, 11,900 IPs Page 26
27 Mitigation o Local DNS blocklist methods o Global Kill domain with registrar Kill mothership o Getting tougher with new features from registrars o ICANN SSAC Page 27
28 Fast Flux Data Availability o ATLAS public portal o Free accounts o Recently added domain list o Actively tracks fast flux domains a day Page 28
29 Missing Data o Registrar data Would be valuable Key for cleanup, remediation o Malcode/family o Content/purpose Inferred post-facto o NS records Double flux Common NS, hosting nets Page 29
30 Acknowledgements o ATLAS, ASERT teams at Arbor o Robert o Thorsten o Jeff and William (SURBL) o Carol and everyone at FIRST Page 30
Global DDoS Measurements. Jose Nazario, Ph.D. NSF CyberTrust Workshop
Global DDoS Measurements Jose Nazario, Ph.D. jose@arbor.net NSF CyberTrust Workshop Quick Outline, Conclusions o Measurements - We re screwed o Observations - We know who o The wrong approach: point solutions
Luminous: Bringing Big(ger) Data to the Fight
Luminous: Bringing Big(ger) Data to the Fight Norm Ritchie Drew Bagley ICANN Helsinki June, 2016 Secure Domain Foundation Non-profit Founded in 2014 Proactive mitigation of malicious domains used for cybercrime
P2P Botnet Detection through Malicious Fast Flux Network Identification
P2P Botnet Detection through Malicious Fast Flux Network Identification David Zhao Department of Electrical and Computer Engineering University of Victoria Victoria, BC, Canada davidzhao@ieee.org Issa
Behavior Based Malware Analysis: A Perspective From Network Traces and Program Run-Time Structure
Behavior Based Malware Analysis: A Perspective From Network Traces and Program Run-Time Structure Chun-Ying Huang chuang@ntou.edu.tw Assistant Professor Department of Computer Science and Engineering National
Discovering new malicious domains using DNS and big data Case study: Fast Flux domains. Dhia Mahjoub OpenDNS May 25 th, 2013
Discovering new malicious domains using DNS and big data Case study: Fast Flux domains Dhia Mahjoub OpenDNS May 25 th, 2013 Background A@ackers seek to keep their operabons online at all Bmes The Network
Detecting Malicious Web Links and Identifying Their Attack Types
Detecting Malicious Web Links and Identifying Their Attack Types Anti-Spam Team Cellopoint July 3, 2013 Introduction References A great effort has been directed towards detection of malicious URLs Blacklisting
DNS Anomaly Detection
DNS Anomaly Detection superdad Nick Barendregt Hidde van der Heide Agenda Introduction Methods Results Conclusion Questions and Discussion 3 / 25 Introduction "Examine the feasibility of detecting malware
A SUBSYSTEM FOR FAST (IP) FLUX BOTNET DETECTION
Chapter 6 A SUBSYSTEM FOR FAST (IP) FLUX BOTNET DETECTION 6.1 Introduction 6.1.1 Motivation Content Distribution Networks (CDNs) and Round-Robin DNS (RRDNS) are the two standard methods used for resource
TempR: Application of Stricture Dependent Intelligent Classifier for Fast Flux Domain Detection
I. J. Computer Network and Information Security, 2016, 10, 37-44 Published Online October 2016 in MECS (http://www.mecs-press.org/) DOI: 10.5815/ijcnis.2016.10.05 TempR: Application of Stricture Dependent
Tracking Evil with Passive DNS
Tracking Evil with Passive DNS Bojan Ždrnja, CISSP, GCIA, GCIH Bojan.Zdrnja@infigo.hr INFIGO IS http://www.infigo.hr Who am I? Senior information security consultant with INFIGO IS (Croatia) Mainly doing
Botnets: A Survey. Rangadurai Karthick R [CS10S009] Guide: Dr. B Ravindran
![Botnets: A Survey. Rangadurai Karthick R [CS10S009] Guide: Dr. B Ravindran](/thumbs/74/71041827.jpg "Botnets: A Survey. Rangadurai Karthick R [CS10S009] Guide: Dr. B Ravindran")
08-08-2011 Guide: Dr. B Ravindran Outline 1 Introduction 2 3 4 5 6 2 Big Picture Recent Incidents Reasons for Study Internet Scenario Major Threats Flooding attacks Spamming Phishing Identity theft, etc.
An Eye on the Storm: Inside the Storm Epidemic. Josh Ballard Network Security Analyst Kansas State University
An Eye on the Storm: Inside the Storm Epidemic Josh Ballard Network Security Analyst Kansas State University bal@k-state.edu Contents The Headlines Peer-to-peer network So just how big is this thing? How
Passive Detection of Misbehaving Name Servers
Passive Detection of Misbehaving Name Servers Based on CMU/SEI-2013-TR-010 Jonathan Spring, Leigh Metcalf netsa-contact (AT) cert.org Flocon 2014, Charleston SC 2014 Carnegie Mellon University Copyright
Use Cases. E-Commerce. Enterprise
Use Cases E-Commerce Enterprise INTRODUCTION This document provides a selection of customer use cases applicable for the e-commerce sector. Each use case describes an individual challenge faced by e-commerce
SSAC Fast Flux Activities
SSAC Fast Flux Activities Dave Piscitello ICANN SSAC ICANN SSAC, Cairo Nov 2008 Page 1 Long and Winding Road January 2008: SAC 025 Fast Flux Hosting and DNS Result of 4 month study and cooperative work
Identifier Technology Health Indicators (ITHI) Alain Durand, Christian Huitema 13 March 2018
Identifier Technology Health Indicators (ITHI) Alain Durand, Christian Huitema 13 March 2018 ITHI Principles of Operation Technical focus Problem areas à Metrics à Measurement Current value and trend over
The Domain Abuse Activity Reporting System (DAAR)
The Domain Abuse Activity Reporting System (DAAR) Dave Piscitello APWG EU October 2017 The Domain Abuse Activity Reporting system What is the Domain Abuse Activity Reporting system? A system for reporting
GNSO Issues Report on Fast Flux Hosting
GNSO STATUS OF THIS DOCUMENT This is the requested by the GNSO Council. SUMMARY This report is submitted to the GNSO Council in response to a request received from the Council pursuant to a Motion proposed
Real-Time Detection of Fast Flux Service Networks
Cybersecurity Applications & Technology Conference For Homeland Security Real-Time Detection of Fast Flux Service Networks Alper Caglayan, Mike Toothaker, Dan Drapeau, Dustin Burke and Gerry Eaton Milcord
Detecting Abuse in TLDs
Detecting Abuse in TLDs A NameSentry TM presentation by Greg Aaron and Michael Young ICANN Toronto: 15 October 2012 2012 Illumintel Inc. All rights reserved. 1 Defining Abuse Every service provider has
Temporal Correlations between Spam and Phishing Websites
Temporal Correlations between Spam and Phishing Websites, Richard Clayton and Henry Stern Center for Research on Computation and Society Harvard University USENIX LEET 09 Boston, MA April 21, 2009 Outline
DNS Firewall with Response Policy Zone. Suman Kumar Saha bdcert Amber IT Limited
DNS Firewall with Response Policy Zone Suman Kumar Saha bdcert suman@bdcert.org Amber IT Limited suman@amberit.com.bd DNS Response Policy Zone(RPZ) as Firewall RPZ allows a recursive server to control
The evolution of malevolence
Detection of spam hosts and spam bots using network traffic modeling Anestis Karasaridis Willa K. Ehrlich, Danielle Liu, David Hoeflin 4/27/2010. All rights reserved. AT&T and the AT&T logo are trademarks
DNS. A Massively Distributed Database. Justin Scott December 12, 2018
DNS A Massively Distributed Database Justin Scott December 12, 2018 What is DNS? Translates Hostnames to IP Addresses What is DNS? Example: www.serverlogic.com 23.185.0.4 What is DNS? Example: www.serverlogic.com
Naming in Distributed Systems
Naming in Distributed Systems Dr. Yong Guan Department of Electrical and Computer Engineering & Information Assurance Center Iowa State University Outline for Today s Talk Overview: Names, Identifiers,
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson olafur@cloudflare.com How long does it take to? Post a new selfie on Facebook and all your friends to be notified few seconds
Intelligent and Secure Network
Intelligent and Secure Network BIG-IP IP Global Delivery Intelligence v11.2 IP Intelligence Service Brian Boyan - b.boyan@f5.com Tony Ganzer t.ganzer@f5.com 2 Agenda Welcome & Intro Introduce F5 IP Intelligence
DNSSM: A Large Scale Passive DNS Security Monitoring Framework
samuel.marchal@uni.lu 16/04/12 DNSSM: A Large Scale Passive DNS Security Monitoring Framework Samuel Marchal, Jérôme François, Cynthia Wagner, Radu State, Alexandre Dulaunoy, Thomas Engel, Olivier Festor
Web Portal User Manual for
Web Portal User Manual for Copyright 2009 Afilias Limited Contents 1. Introduction... 1 1.1 About Afilias Managed DNS Service... 1 1.2 Afilias Managed DNS Service Website Help... 1 1.3 Support... 2 2.
IoT - Next Wave of DDoS? IoT Sourced DDoS Attacks A Focus on Mirai Botnet and Best Practices in DDoS Defense
IoT - Next Wave of DDoS? IoT Sourced DDoS Attacks A Focus on Mirai Botnet and Best Practices in DDoS Defense DDoS Attacks Increasing in Size, Frequency & Complexity Arbor Networks WISR XII Largest attack
Chapter 2 Malicious Networks for DDoS Attacks
Chapter 2 Malicious Networks for DDoS Attacks Abstract In this chapter, we explore botnet, the engine of DDoS attacks, in cyberspace. We focus on two recent techniques that hackers are using to sustain
Sponsor s Monthly Report for.coop TLD
Sponsor s Monthly Report for.coop TLD Reporting period: May 2011 In this report the terms dotcoop, Registry and Sponsor refer to DotCooperation LLC, the Sponsor of the dotcoop TLD. Table of Contents 1
Supercharge Your SIEM: How Domain Intelligence Enhances Situational Awareness
Supercharge Your SIEM: How Domain Intelligence Enhances Situational Awareness Introduction Drowning in data but starving for information. It s a sentiment that resonates with most security analysts. For
Threat Detection and Mitigation for IoT Systems using Self Learning Networks (SLN)
Threat Detection and Mitigation for IoT Systems using Self Learning Networks (SLN) JP Vasseur, PhD - Cisco Fellow jpv@cisco.com Maik G. Seewald, CISSP Sr. Technical Lead maseewal@cisco.com June 2016 Cyber
APNIC Cooperation SIG: Anti-Abuse Community Development
M3AAWG @ APNIC Cooperation SIG: Anti-Abuse Community Development Jesse Sowell, PhD Special Advisor to M3AAWG; Vice-Chair of Growth and Develop Directing Outreach NANOG Program Committee Cybersecurity Fellow
Botnet Population and Intelligence Gathering Techniques
Botnet Population and Intelligence Gathering Techniques David Dagon 1 & Chris Davis 2 dagon@cc.gatech.edu Georgia Institute of Technology College of Computing cdavis@damballa.com Damballa, Inc. BlackHat
DNS Security. Ch 1: The Importance of DNS Security. Updated
DNS Security Ch 1: The Importance of DNS Security Updated 8-21-17 DNS is Essential Without DNS, no one can use domain names like ccsf.edu Almost every Internet communication begins with a DNS resolution
Update on Whois Studies
Update on Whois Studies 1 1 Current Status Final GNSO-commissioned Whois studies now completed, awaiting public comment Whois Privacy & Proxy Abuse Study Performed by National Physical Laboratory, UK Public
Configuring Botnet Traffic Filtering Using Cisco Security Manager 4.0
Configuring Botnet Traffic Filtering Using Cisco Security Manager 4.0 First Published: June 2010 Abstract Botnets are a collection of malicious software or bots covertly installed on endpoints and controlled
Dell SonicWALL Secure Mobile Access 8.5. Geo IP & Botnet Filters Feature Guide
Dell SonicWALL Secure Mobile Access 8.5 2016 Dell Inc. ALL RIGHTS RESERVED. This product is protected by U.S. and international copyright and intellectual property laws. Dell, the Dell logo, and SonicWALL
DNS/DNSSEC Workshop. In Collaboration with APNIC and HKIRC Hong Kong. Champika Wijayatunga Regional Security Engagement Manager Asia Pacific
DNS/DNSSEC Workshop In Collaboration with APNIC and HKIRC Hong Kong Champika Wijayatunga Regional Security Engagement Manager Asia Pacific 22-24 January 2018 1 Agenda 1 2 3 Introduction to DNS DNS Features
Botnet Communication Topologies
Understanding the intricacies of botnet Command-and-Control By Gunter Ollmann, VP of Research, Damballa, Inc. Introduction A clear distinction between a bot agent and a common piece of malware lies within
Passive DNS Replication
Passive DNS Replication Florian Weimer 17 th Annual FIRST Conference, Singapore, 2005 Florian Weimer Passive DNS Replication FIRST 2005 1 / 24 Outline A very brief introduction to DNS Case Study: Botnet
Detecting Malicious URLs. Justin Ma, Lawrence Saul, Stefan Savage, Geoff Voelker. Presented by Gaspar Modelo-Howard September 29, 2010.
Detecting Malicious URLs Justin Ma, Lawrence Saul, Stefan Savage, Geoff Voelker Presented by Gaspar Modelo-Howard September 29, 2010 Publications Justin Ma, Lawrence K. Saul, Stefan Savage, and Geoffrey
Techniques, Tools and Processes to Help Service Providers Clean Malware from Subscriber Systems
Techniques, Tools and Processes to Help Service Providers Clean Malware from Subscriber Systems Barry Raveendran Greene, bgreene@senki.org October 22, 2012, Baltimore, Maryland, USA M3AAWG 26th General
THE ACCENTURE CYBER DEFENSE SOLUTION
THE ACCENTURE CYBER DEFENSE SOLUTION A MANAGED SERVICE FOR CYBER DEFENSE FROM ACCENTURE AND SPLUNK. YOUR CURRENT APPROACHES TO CYBER DEFENSE COULD BE PUTTING YOU AT RISK Cyber-attacks are increasingly
GFI Product Comparison. GFI MailEssentials vs Sophos PureMessage
GFI Product Comparison GFI MailEssentials vs PureMessage GFI MailEssentials Integrates with Microsoft Exchange Server 2003/2007/2010/2013 Scans incoming and outgoing emails Scans internal emails within
Network Protocols. DNS Intel *slightly modified public version of another talk. TDC 375 Autumn 2009/10 John Kristoff DePaul University 1
Network Protocols DNS Intel *slightly modified public version of another talk TDC 375 Autumn 2009/10 John Kristoff DePaul University 1 What's in a name? dns research01.cti.depaul.edu. TDC 375 Autumn 2009/10
Avoiding Information Overload: Automated Data Processing with n6
Avoiding Information Overload: Automated Data Processing with n6 Paweł Pawliński pawel.pawlinski@cert.pl 26th annual FIRST conference Boston, June 23rd 2014 Who we are part of national CERT for Poland
Improved C&C Traffic Detection Using Multidimensional Model and Network Timeline Analysis
Improved C&C Traffic Detection Using Multidimensional Model and Elad Menahem Avidan Avraham Modern Threats Are More Sophisticated & Evasive CYBER KILL CHAIN: Infection Phase Post-Infection Recon Weaponization
Trisul Network Analytics - Traffic Analyzer
Trisul Network Analytics - Traffic Analyzer Using this information the Trisul Network Analytics Netfllow for ISP solution provides information to assist the following operation groups: Network Operations
GFI product comparison: GFI MailEssentials vs. McAfee Security for Servers
GFI product comparison: GFI MailEssentials vs. McAfee Security for Email Servers Features GFI MailEssentials McAfee Integrates with Microsoft Exchange Server 2003/2007/2010/2013 Scans incoming and outgoing
WHOIS High-Level Technical Brief
WHOIS High-Level Technical Brief Background When the predecessor to the Internet (the ARPANet) was first being developed, it was quickly determined that there needed to be a contact list of the researchers
PyNetSim A modern INetSim Replacement. Jason Jones FIRST 2017
PyNetSim A modern INetSim Replacement Jason Jones FIRST 2017 BackGround Why? Research teams may need a simulated environment because They are not allowed to directly contact malware C2s Trying to avoid
DEFENCE IN DEPTH HOW ANTIVIRUS, TRADITIONAL FIREWALLS, AND DNS FIREWALLS WORK TOGETHER
DEFENCE IN DEPTH HOW ANTIVIRUS, TRADITIONAL FIREWALLS, AND DNS FIREWALLS WORK TOGETHER D-Zone DNS Firewall 18-10-20171 EXECUTIVE SUMMARY Cyber attacks continue to grow at an alarming rate with ransomware
With turing you can: Identify, locate and mitigate the effects of botnets or other malware abusing your infrastructure
Decoding DNS data If you have a large DNS infrastructure, understanding what is happening with your real-time and historic traffic is difficult, if not impossible. Until now, the available network management
State of the Internet Security Q Mihnea-Costin Grigore Security Technical Project Manager
State of the Internet Security Q2 2017 Mihnea-Costin Grigore Security Technical Project Manager Topics 1. Introduction 2. DDoS Attack Trends 3. Web Application Attack Trends 4. Spotlights 5. Resources
This video will look at how to create some of the more common DNS records on Windows Server using Remote Administration Tools for Windows 8.
This video will look at how to create some of the more common DNS records on Windows Server using Remote Administration Tools for Windows 8. Demonstration The Windows 8 computer has Remote Server Administration
Registrar Session ICANN Contractual Compliance
1 Registrar Session ICANN Contractual Compliance ICANN 60 01 November 2017 2 Agenda Brief Update Since ICANN 58 Registrar Compliance Update Performance Measurement & Reporting Update Contractual Compliance
A Heuristic Approach for the Detection of Malicious Activity at Autonomous System
International Journal of Scientific and Research Publications, Volume 3, Issue 6, June 2013 1 A Heuristic Approach for the Detection of Malicious Activity at Autonomous System Sowmyashree C.S *, Prof.
Sponsor s Monthly Report for.coop TLD
Sponsor s Monthly Report for.coop TLD Reporting period: November In this report the terms dotcoop, Registry and Sponsor refer to DotCooperation LLC, the Sponsor of the dotcoop TLD. Table of Contents 1
S Computer Networks - Spring What and why? Structure of DNS Management of Domain Names Name Service in Practice
Outline What and why? Structure of DNS Management of Domain Names Name Service in Practice 188lecture12.ppt Pirkko Kuusela, Markus Peuhkuri, Jouni Karvo 1 2 Need Network addresses are numbers Addresses
Expiration Date: May 1997 Randy Bush RGnet, Inc. November Clarifications to the DNS Specification. draft-ietf-dnsind-clarify-02.
Network Working Group Internet Draft Expiration Date: May 1997 Robert Elz University of Melbourne Randy Bush RGnet, Inc. November 1996 Clarifications to the DNS Specification Status of this Memo draft-ietf-dnsind-clarify-02.txt
OpenDNS DNS Database Client Library Documentation
OpenDNS DNS Database Client Library Documentation Release 0.1 Frank Denis October 21, 2016 Contents 1 Installation 1 2 Example 3 3 Parallel requests 5 4 Setup 7 5 Note on certificates format 9 6 Operations
Discover threats quickly, remediate immediately, and mitigate the impact of malware and breaches
Discover threats quickly, remediate immediately, and mitigate the impact of malware and breaches Introduction No matter how hard you work to educate your employees about the constant and evolving threats
DNS Abuse Handling. FIRST TC Noumea New Caledonia. Champika Wijayatunga Regional Security, Stability and Resiliency Engagement Manager Asia Pacific
DNS Abuse Handling FIRST TC Noumea New Caledonia Champika Wijayatunga Regional Security, Stability and Resiliency Engagement Manager Asia Pacific 10 September 2018 1 The Domain Name System (DNS) The root
Detecting Malicious Flux Service Networks through Passive Analysis of Recursive DNS Traces
Detecting Malicious Flux Service Networks through Passive Analysis of Recursive DNS Traces Roberto Perdisci a,b, Igino Corona c, David Dagon a, and Wenke Lee a a College of Computing, Georgia Institute
RESELLER LOGO RADICALLY BETTER. DDoS PROTECTION. Radically more effective, radically more affordable solutions for small and medium enterprises
RESELLER LOGO RADICALLY BETTER DDoS PROTECTION Radically more effective, radically more affordable solutions for small and medium enterprises IT S TIME TO GET SERIOUS ABOUT CYBER CRIME Despite the headline
Protecting Against Modern Attacks. Protection Against Modern Attack Vectors
Protecting Against Modern Attacks Protection Against Modern Attack Vectors CYBER SECURITY IS A CEO ISSUE. - M C K I N S E Y $4.0M 81% >300K 87% is the average cost of a data breach per incident. of breaches
Use Cases. Media & Telecom. Enterprise
Use Cases Media & Telecom Enterprise INTRODUCTION This document provides a selection of customer use cases applicable for the media and telecom sector. Each use case describes an individual challenge faced
Endpoint Protection : Last line of defense?
Endpoint Protection : Last line of defense? First TC Noumea, New Caledonia 10 Sept 2018 Independent Information Security Advisor OVERVIEW UNDERSTANDING ENDPOINT SECURITY AND THE BIG PICTURE Rapid development
(Botnets and Malware) The Zbot attack. Group 7: Andrew Mishoe David Colvin Hubert Liu George Chen John Marshall Buck Scharfnorth
(Botnets and Malware) The Zbot attack Group 7: Andrew Mishoe David Colvin Hubert Liu George Chen John Marshall Buck Scharfnorth What Happened? Type of Attack Botnet - refers to group of compromised computers
DATA SCIENCE OR BLACK MAGIC CYBERSECURITY THREATS IN CANADA
DATA SCIENCE OR BLACK MAGIC CYBERSECURITY THREATS IN CANADA BCNET Conference April 24th, 2018 Shawn Beaton Copyright 2018 Canadian Internet Registration Authority ( CIRA ). All rights reserved. This material
Botnet Detection. Botnet Detection for Communications Service Providers
Botnet Detection Botnet Detection for Communications Service Providers Table of Contents Introduction:... 3 Beyond the Enterprise Network... 4 Network-based Botnet Detection... 5 CnC Communication Identification...
How to Add Domains and DNS Records
Configure the Barracuda NextGen X-Series Firewall to be the authoritative DNS server for your domains or subdomains to take advantage of Split DNS or dead link detection. Step 1. Make the X-Series Firewall
MISHIMA: Multilateration of Internet hosts hidden using malicious fast-flux agents (Short Paper)
MISHIMA: Multilateration of Internet hosts hidden using malicious fast-flux agents (Short Paper) Greg Banks, Aristide Fattori, Richard Kemmerer, Christopher Kruegel, and Giovanni Vigna University of California,
Fast Flux Hosting Final Report. GNSO Council Meeting 13 August 2009
Fast Flux Hosting Final Report GNSO Council Meeting 13 August 2009 1 January 2008: SAC 025 Fast Flux Hosting and DNS Characterizes Fast Flux (FF) as an evasion technique that enables cybercriminals to
Passive DNS. Using the DNS for fun and profit. Alexandre Dulaunoy. March 4, Alexandre Dulaunoy Passive DNS
Using the DNS for fun and profit March 4, 2016 Domain Name Space and Structure Domain Name Space and Structure 1/3 The domain name space is structured in a tree. The DNS root zone is at the top and provide
Business Continuity Management
University of Oslo INF3510 Information Security Autumn 2018 Workshop Questions and s Lecture 8: Risk Management and Business Continuity Management Question 1: Risk factors A possible definition of information
PROFOX ASSOCIATES, INC. Oximetry: Comprehensive Report Comments: Overnight study breathing room air.
Oximetry: Comprehensive Report Recording time: 05:25:40 Highest pulse: 86 Highest SpO2: 97% Excluded sampling: 00:01:52 Lowest pulse: 52 Lowest SpO2: 72% Total valid sampling: 05:23:48 Mean pulse: 62 Mean
May the (IBM) X-Force Be With You
Ann Arbor, Michigan July 23-25 May the (IBM) X-Force Be With You A QUICK PEEK INTO ONE OF THE MOST RENOWNED SECURITY TEAMS IN THE WORLD Marlon Machado Worldwide Standardization Leader, Application Security
Automating Security Response based on Internet Reputation
Add Your Logo here Do not use master Automating Security Response based on Internet Reputation IP and DNS Reputation for the IPS Platform Anthony Supinski Senior Systems Engineer www.h3cnetworks.com www.3com.com
SURBL-Listed Domains And Their Registrars (In Just Seven or Eight Minutes)
SURBL-Listed Domains And Their Registrars (In Just Seven or Eight Minutes) Joe St Sauver, Ph.D. (joe@uoregon.edu or joe@internet2.edu) Forum on DNS Abuse Grand Ballroom, 14 Mar 2011 11:30-13:00 ICANN 40,
Protecting DNS Critical Infrastructure Solution Overview. Radware Attack Mitigation System (AMS) - Whitepaper
Protecting DNS Critical Infrastructure Solution Overview Radware Attack Mitigation System (AMS) - Whitepaper Table of Contents Introduction...3 DNS DDoS Attacks are Growing and Evolving...3 Challenges
Finding the Linchpins of the Dark Web: A Study on Topologically Dedicated Hosts on Malicious Web Infrastructures
Finding the Linchpins of the Dark Web: A Study on Topologically Dedicated Hosts on Malicious Web Infrastructures Zhou Li, Indiana University Bloomington Sumayah Alrwais, Indiana University Bloomington
Multidimensional Investigation of Source Port 0 Probing
DIGITAL FORENSIC RESEARCH CONFERENCE Multidimensional Investigation of Source Port 0 Probing By Elias Bou-Harb, Nour-Eddine Lakhdari, Hamad Binsalleeh and Mourad Debbabi Presented At The Digital Forensic
HELP ME NETWORK VISIBILITY AND AI; YOU RE OUR ONLY HOPE
SESSION ID: SPO3-T10 HELP ME NETWORK VISIBILITY AND AI; YOU RE OUR ONLY HOPE Chris Morales Head of Security Analytics Vectra Networks Steve McGregory Sr. Director, Threat Intelligence Research Center Ixia,
Covert channel detection using flow-data
Covert channel detection using flow-data Guido Pineda Reyes MSc. Systems and Networking Engineering University of Amsterdam July 3, 2014 Guido Pineda Reyes (UvA) Covert channel detection using flow-data
Overview. Last Lecture. This Lecture. Next Lecture. Scheduled tasks and log management. DNS and BIND Reference: DNS and BIND, 4 th Edition, O Reilly
Last Lecture Overview Scheduled tasks and log management This Lecture DNS and BIND Reference: DNS and BIND, 4 th Edition, O Reilly Next Lecture Address assignment (DHCP) TELE 301 Lecture 11: DNS 1 TELE
WHITE PAPER. Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale
WHITE PAPER Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale One key number that is generally
Managing Caching DNS Server
This chapter explains how to set the Caching DNS server parameters. Before you proceed with the tasks in this chapter, see Introduction to the Domain Name System which explains the basics of DNS. Configuring
Configuring the Botnet Traffic Filter
CHAPTER 46 Malware is malicious software that is installed on an unknowing host. Malware that attempts network activity such as sending private data (passwords, credit card numbers, key strokes, or proprietary
Network Protocols. Domain Name System (DNS) TDC375 Autumn 2010/11 John Kristoff - DePaul University 1
Network Protocols Domain Name System (DNS) TDC375 Autumn 2010/11 John Kristoff - DePaul University 1 One of two critical systems Routing (BGP) and naming (DNS) are by far the two most critical subsystems
Global Phishing Survey 2H2009
Global Phishing Survey 2H2009 Greg Aaron Rod Rasmussen Released May 11, 2010 http://apwg.org/reports/apwg_globalphishingsurvey_2h2009.pdf Goals Study domain names and URLs to: Provide a consistent benchmark
Attacking Networks. Joshua Wright LightReading LIVE! October 1, 2003
Attacking 802.11 Networks Joshua Wright Joshua.Wright@jwu.edu LightReading LIVE! October 1, 2003 Attention The material presented here reflects the personal experience and opinions of the author, and not
ARIN Policies How to Qualify for Number Resources. Leslie Nobile
ARIN Policies How to Qualify for Number Resources Leslie Nobile Director, Registration Services ARIN Policies IPv4 IPv6 ASN Terms Allocate to issue number resources to ISPs (LIRs) for internal networks
GFI product comparison: GFI MailEssentials vs Symantec Mail Security for Microsoft Exchange 7.5
GFI product comparison: GFI MailEssentials vs Symantec Mail Security for Microsoft Exchange 7.5 Features GFI MailEssentials Symantec Mail Security for Microsoft Exchange 7.5 Integrates with Microsoft Exchange
Detection of DNS Traffic Anomalies in Large Networks
Detection of Traffic Anomalies in Large Networks Milan Čermák, Pavel Čeleda, Jan Vykopal {cermak celeda vykopal}@ics.muni.cz 20th Eunice Open European Summer School and Conference 2014 1-5 September 2014,
8 Must Have. Features for Risk-Based Vulnerability Management and More
8 Must Have Features for Risk-Based Vulnerability Management and More Introduction Historically, vulnerability management (VM) has been defined as the practice of identifying security vulnerabilities in
Transnational Anti-Abuse Working Group (AAWG) Development
Transnational Anti-Abuse Working Group (AAWG) Development Jesse Sowell, PhD Senior Advisor Vice-Chair of Growth and Develop Directing Outreach Cybersecurity Fellow; Stanford Center for International Security