Eric.freyssinet: 1 revision imported

2015-02-07T14:30:17Z

1 revision imported

← Older revision		Revision as of 14:30, 7 February 2015
(No difference)

Eric.freyssinet at 14:36, 14 August 2013

2013-08-14T14:36:02Z

New page

{{Publication
|Type=Conference paper
|Link=http://user.informatik.uni-goettingen.de/~krieck/docs/2012a-aisec.pdf user.informatik.uni-goettingen.de
|Author=Tammo Krueger, Hugo Gascon, Nicole Krämer, Konrad Rieck
|NomRevue=AISEC proceedings
|Date=2012
|Editor=ACM
|Year=2012
|Abstract=Attacks like call fraud and identity theft often involve sophisticated stateful attack patterns which, on top of normal communication, try to harm systems on a higher semantic
level than usual attack scenarios. To detect these kind of threats via specially deployed honeypots, at least a minimal understanding of the inherent state machine of a specific
service is needed to lure potential attackers and to keep a communication for a sufficiently large number of steps. To this end we propose PRISMA, a method for protocol inspection and state machine analysis, which infers a functional state machine and message format of a protocol from network traffic alone. We apply our method to three real-life
network traces ranging from 10,000 up to 2 million messages of both binary and textual protocols. We show that PRISMA is capable of simulating complete and correct sessions based on the learned models. A case study on malware traffic reveals the different states of the execution, rendering PRISMA a valuable tool for malware analysis.
|Keyword=Markov Models, Clustering, Non-negative Matrix Factorization, Honeypots, State Machine Inference
}}

Learning stateful models for network honeypots - Revision history

Eric.freyssinet: 1 revision imported

Eric.freyssinet at 14:36, 14 August 2013