Eric.freyssinet: Text replacement - "/ www." to "/ |Site=www."

2015-07-31T10:46:12Z

Text replacement - "/ www." to "/ |Site=www."

← Older revision		Revision as of 10:46, 31 July 2015
Line 4:		Line 4:
	\|Legend=		\|Legend=
	\|Document=Knowyourenemy-trackingbotnets.pdf		\|Document=Knowyourenemy-trackingbotnets.pdf
	\|Link=http://www.honeynet.org/papers/bots/ www.honeynet.org		\|Link=http://www.honeynet.org/papers/bots/
			\|Site=www.honeynet.org
	\|Author=Paul Bächer, Thorsten Holz, Markus Kötter, Georg Wicherski		\|Author=Paul Bächer, Thorsten Holz, Markus Kötter, Georg Wicherski
	\|NomRevue=Honeynet papers		\|NomRevue=Honeynet papers

Eric.freyssinet: 1 revision imported

2015-02-07T14:22:15Z

1 revision imported

← Older revision	Revision as of 14:22, 7 February 2015
(No difference)

Eric.freyssinet at 16:36, 7 January 2012

2012-01-07T16:36:21Z

New page

{{Publication
|Titre=
|Image=
|Legend=
|Document=Knowyourenemy-trackingbotnets.pdf
|Link=http://www.honeynet.org/papers/bots/ www.honeynet.org
|Author=Paul Bächer, Thorsten Holz, Markus Kötter, Georg Wicherski
|NomRevue=Honeynet papers
|Date=
|Editor=Honeynet projects
|Year=2008
|Page=
|Abstract=Honeypots are a well known technique for discovering the tools, tactics, and motives of attackers. In this paper we look at a special kind of threat: the individuals and organizations who run botnets. A botnet is a network of compromised machines that can be remotely controlled by an attacker. Due to their immense size (tens of thousands of systems can be linked together), they pose a severe threat to the community. With the help of honeynets we can observe the people who run botnets - a task that is difficult using other techniques. Due to the wealth of data logged, it is possible to reconstruct the actions of attackers, the tools they use, and study them in detail. In this paper we take a closer look at botnets, common attack techniques, and the individuals involved.

We start with an introduction to botnets and how they work, with examples of their uses. We then briefly analyze the three most common bot variants used. Next we discuss a technique to observe botnets, allowing us to monitor the botnet and observe all commands issued by the attacker. We present common behavior we captured, as well as statistics on the quantitative information learned through monitoring more than one hundred botnets during the last few months. We conclude with an overview of lessons learned and point out further research topics in the area of botnet-tracking, including a tool called mwcollect2 that focuses on collecting malware in an automated fashion.
}}

Know your enemy: tracking botnets - Revision history

Eric.freyssinet: Text replacement - "/ www." to "/ |Site=www."

Eric.freyssinet: 1 revision imported

Eric.freyssinet at 16:36, 7 January 2012