Upload File

pavel kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (netflow data...

  • Home
  • Documents
  • Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable
9
& Pavel Kácha [email protected]

Upload: nguyenkhanh

Post on 04-Apr-2018

216 views

Category:

Documents


1 download

Report

TRANSCRIPT

Page 1: Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable

&

Pavel Ká[email protected]

Page 2: Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable

7. 2. 2016

Zdroje dat

- HW accelerated probes- large scale (backbone-wide) flow based monitoring (NetFlow data sources)- Honey Pots- IDS, IPS, tar pit based systems, etc.. - SNMP based monitoring

Page 3: Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable

7. 2. 2016

Warden● Komunitní přístup

– Tvá data jsou dostupná Warden komunitě– Data celé komunity jsou dostupná Tobě

● BSD licence, https://warden.cesnet.cz

Page 4: Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable

7. 2. 2016

Formát – IDEA

● JSON● Jednoduchý, rozšiřitelný formát● Jednou definované klíče a typy se ale nemění● Dokážeme rozlišit primární data, agregovaná data, korelovaná data● Definice: https://idea.cesnet.cz

Page 5: Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable

7. 2. 2016

Mentat● https://mentat.cesnet.cz

Page 6: Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable

7. 2. 2016

Mentat – reporter 

Page 7: Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable

7. 2. 2016

Spolupráce

● SABUVýměna v rámci ČR

●

Sdílení v rámci EU NRENů

● IHAP

● PROKI

Page 8: Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable

7. 2. 2016

Komunita

● Spravujete nějaké bezpečnostní nástroje ve své infrastruktuře?– Honeypoty– Sondy– IDS, IPS– Siem– …

● Jste správcem infrastruktury organizace a pomohou vám další informace?● Jste výzkumník a potřebujete data?● Jste student a sháníte téma na diplomku/bakalářku/semestrálku?

[email protected]

Page 9: Pavel Kácha ph@cesnet · - large scale (backbone-wide) flow based monitoring (NetFlow data sources) - Honey Pots - IDS, IPS, tar ... Intrusion Botnet/MaIware Recon Scanning Vulnerable

7. 2. 2016

Děkuji za pozornost

GNU Terry Pratchett


Služby e-Infrastruktury CESNET · Služby e-infrastruktury CESNET Agregovaný aktuální souhrn služeb e-infrastruktury CESNET – Síťové služby, přístup do síťové části

Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Understanding NetFlow Monitoring, Security, and … · Understanding NetFlow Monitoring, Security, and Forensics By: Dr. Vincent Berk and Dr. John Murphy ... botnet? Compromised hosts

DDoS Analysis and Mitigation - Black Hat · DDoS Analysis and Mitigation ... - Infrastructure (Netflow) >Detection - ACLs and queue counters - Netflow based ... >Running an own botnet

Network Traffic Monitoring & Security - CESNET · Network Traffic Monitoring & Security ... final recommendation –monitor network by the NetFlow probe ... •Several workstations

Protographs: Graph-Based Approach to NetFlow Analysis · Protographs: Graph-Based Approach to NetFlow Analysis Jeff Janies ... BotNet, P2P, Established services. Protograph Tool •

LNCS 6155 - Mining NetFlow Records for Critical Network ... · SMTP traffic or botnet membership. For scoring such relevant IP flow records ... NetFlow record A causes NetFlow records

Peer-to-Peer Botnet Detection Using NetFlowdelaat.net/rp/2013-2014/p65/presentation.pdf · Peer-to-Peer Botnet Detection Using NetFlow Connor Dillon System and Network Engineering

Configuring NetFlow and NDE - CiscoChapter 56 Configuring NetFlow and NDE Understanding How NetFlow and NDE Work • NetFlow and NDE on the PFC, page 56-2 NetFlow and NDE Overview

Your Botnet is My Botnet: Analysis of a Botnet Takeoverchris/research/doc/ccs09... · 2020-06-06 · Your Botnet is My Botnet: Analysis of a Botnet Takeover Brett Stone-Gross, Marco

The Solution - CESNET

NetFlow Integrator Standard · NetFlow Integrator Standard Edition Administrators Guide NetFlow Logic Confidential 3 Overview How NetFlow Integrator Works NetFlow Integrator (NFI)

NetFlow for Incident Response - Cybersecurity · •Increase botnet nodes for attacks. Why Can’t You Detect Them? •Zero Day •No signature match •They make outbound connections

Flowmon Solution - ALEF · Flowmon Solution [email protected] Your Network Under Control ... Botnet Infection FM Probe Netflow Data Collection Learning Baselines FlowMon Collector

AdventNet ManageEngine NetFlow Anayzer :: Help Docuementationmanageengine.pt/products/netflow/NetFlowAnalyzer_UserGuide.pdf · AdventNet ManageEngine NetFlow Anayzer :: Help Docuementation

Paper Presentation - "Your Botnet is my Botnet : Analysis of a Botnet Takeover"

Your Botnet is My Botnet : Analysis of a Botnet Takeover

Computer Security 101 Internet and Email Safety · • Participants contribute firewall logs, netflow, botnet alerts (Einstein); arbitrary devices under monitoring

Author's personal copy - UNRbebis/netflowreview_JNCA.pdf · Botnet ... NetFlow is a traf c monitoring technology developed by Darren and Barry Bruins in 1996 at Cisco ... Author's

Datová úložiště CESNET

NetFlow Analysis FINAL - SEI Digital Library · There is information available via NetFlow Analysis to help secure your ... botnet any flow sourced utah.edu destination ... NetFlow_Analysis_FINAL.key

Detecting Botnets with NetFlow - Carnegie Mellon University · BasedonNetFlowandothernetworkdatasources. Processesdataregularlyandprovidesreal-timeoutput. ... project CYBER, botnet

Teredo & 6to4 - CESNET

Configuring NetFlow and NDE - Cisco · Understanding How NetFlow and NDE Work NetFlow and NDE Overview NetFlow collects statistics about traffic that flows through the router. NetFlow

White PaPer - paramountassure.com · Page 2 White Paper: 14 Ways to Leverage NetFlow for Network Performance & Security ... Botnet Detection 15 Worm Detection 16 Compliance – HIPAA,

Botnet Detection and Mitigation - pdfs.semanticscholar.org · the characteristics of a bad botnet NetFlow records. This enabled us to validate the construction of data flow diagrams

CESNET Association and CESNET2 Network Jan Gruntorád Managing Director CESNET

PRACTICAL EXPERIENCES OF BUILDING IPFIX B … · OUTLINE RESEARCH PROBLEM: Botnet detection in Cloud Providers FLOW: IPFIX and NetFlow CONCEPTUAL FRAMEWORK: Build environment & challenges

DETECTING BOTNETS BASED ON THEIR BEHAVIORS … · NetFlow and other similar network level ... Therefore we decided to detect botnet in the netflow logs from the naïve detection

Cisco ASA and NetFlow - Using ASA NetFlow with LiveActioncdnx.liveaction.com/knowledgeBase/Configuration-Cisco-ASA-and-NetFlow... · 1-1 Cisco ASA and NetFlow – Using ASA NetFlow

SonicOS 5.8: NetFlow Reporting - Questsupport-public.cfm.quest.com/cc910f70-9ed2-496e-a848-25b...NetFlow Reporting Overview SonicOS 5.8 NetFlow Reporting Feature Guide 3 NetFlow Export

Botnet Dection system. Introduction Botnet problem Challenges for botnet detection

Your Botnet is My Botnet: Analysis of a Botnet Takeoverchris/research/doc/ccs09_botnet.pdf · Your Botnet is My Botnet: Analysis of a Botnet Takeover Brett ... (such as bank account

Based Botnet Detection Using Netflow Data Towards

NetFlow Optimizer™ - Network Monitoring & Analysis · Botnet Command and Control Traffic Monitor ... NetFlow Optimizer Modules and Converters are designed to provide solutions for