ScriptGen: An Automated Script Generation Tool for honeyd

Friday, February 10. 2006
At the 21st Annual Computer Security Applications Conference (ACSAC 2005) back in December 2005, several people from Eurecom presented a paper about automated script generation for honeyd.

The paper entitled "ScriptGen: an automated script generation tool for honeyd" by Corrado Leita, Ken Mermoud, and Marc Dacier presents a tool to generate scripts that can then be used together with honeyd. The basic steps of the tools are:

  1. Deploy a honeypot and record all network traffic

  2. Build a state machine based on the captured data

  3. Simplify the state machine and generate a corresponding honeyd script


The results are promising and can presumably help to easily build new scripts for honeyd. In overall, this tool is similar to HoneyBee. Honeybee can also automatically create new honeyd scripts, but relies on a scanner to actively learn the characteristics of a protocol.

Abstract:
Honeyd is a popular tool developed by Niels Provos that offers a simple way to emulate services offered by several machines on a single PC. It is a so called low interaction honeypot. Responses to incoming requests are generated thanks to ad hoc scripts that need to be written by hand. As a result, few scripts exist, especially for services handling proprietary protocols. In this paper, we propose a method to alleviate these problems by automatically generating new scripts. We explain the method and describe its limitations. We analyze the quality of the generated scripts thanks to two different methods. On the one hand, we have launched known attacks against a machine running our scripts; on the other hand, we have deployed that machine on the Internet, next to a high interaction honeypot during two months. For those attackers that have targeted both machines, we can verify if our scripts have, or not, been able to fool them. We also discuss the various tuning parameters of the algorithm that can can be set to either increase the quality of the script or, at the contrary, to reduce its complexity.

Continue reading "ScriptGen: An Automated Script Generation Tool for honeyd"

Posted by Thorsten Holz in paper at 18:55 | Comment (1) | Trackback (1)

Modeling Botnet Propagation Using Time Zones

Monday, February 6. 2006
Another interesting paper from NDSS'06 is "Modeling Botnet Propagation Using Time Zones" by David Dagon, Cliff Zou, and Wenke Lee. They introduce a diurnal model of botnet propagation, i.e., a model which includes information about timezone and time of day to predict the propagation of a botnet. Real-world data verify this model and show that the time of day indeed influences botnet propagation. I also examined this phenomenon - more on that in the next blog entry...

Abstract
Time zones play an important and unexplored role in malware epidemics. To understand how time and location affect malware spread dynamics, we studied botnets, or large coordinated collections of victim machines (zombies) controlled by attackers. Over a six month period we observed dozens of botnets representing millions of victims. We noted diurnal properties in botnet activity, which we suspect occurs because victims turn their computers off at night. Through binary analysis, we also confirmed that some botnets demonstrated a bias in infecting regional populations.

Clearly, computers that are offline are not infectious, and any regional bias in infections will affect the overall growth of the botnet. We therefore created a diurnal propagation model. The model uses diurnal shaping functions to capture regional variations in online vulnerable populations.

The diurnal model also lets one compare propagation rates for different botnets, and prioritize response. Because of variations in release times and diurnal shaping functions particular to an infection, botnets released later in time may actually surpass other botnets that have an advanced start. Since response times for malware outbreaks is now measured in hours, being able to predict short-term propagation dynamics lets us allocate resources more intelligently. We
used empirical data from botnets to evaluate the analytical model.

Continue reading "Modeling Botnet Propagation Using Time Zones "

Posted by Thorsten Holz in paper at 16:41 | Comments (0) | Trackbacks (0)

Malicious Malware: Attacking the Attackers, Part 2

Monday, February 6. 2006
The second part of the article on "Malicious Malware: Attacking the Attackers" is now available at securityfocus.
Posted by Thorsten Holz in paper at 13:13 | Comments (-3) | Trackbacks (0)

Malicious Malware: Attacking the Attackers

Wednesday, February 1. 2006
There is a new article on securityfocus from Frederic Raynal and me entitled "Malicious Malware: Attacking the Attackers". In this article, we turn the table and take a look at possible ways to use malware or other offensive options (e.g. fake exploits) to stop an attacker. It's an overview of what we have seen in the past few years in this area and is written in a rather informal style.

Abstract:
This article explores measures to attack those malicious attackers who seek to harm our legitimate systems. The proactive use of exploits and bot networks that fight other bot networks, along with social engineering and attacker techniques are all discussed in an ethical manner. Part one of two.

The second part will be published in the next few days and Fyodor has just released Nmap 4.0.
Posted by Thorsten Holz in paper at 00:07 | Comments (0) | Trackbacks (0)
(Page 1 of 1, totaling 4 entries)