The Nepenthes Platform: An Efficient Approach to Collect Malware
At the RAID'06 conference taking place in Hamburg between September 20 and 22, we published a paper on nepenthes. It describes nepenthes in detail and gives an overview of preliminary results. I had published excerpt from the paper previously here at this blog, but now also the final paper is available.
Abstract:
Up to now, there is little empirically backed quantitative and qualitative knowledge about self-replicating malware publicly available. This hampers research in these topics because many counter-strategies against malware, e.g., network- and host-based intrusion detection systems, need hard empirical data to take full effect.
We present the nepenthes platform, a framework for large-scale collection of information on self-replicating malware in the wild. The basic principle of nepenthes is to emulate only the vulnerable parts of a service. This leads to an efficient and effective solution that offers many advantages compared to other honeypot-based solutions. Furthermore, nepenthes offers a flexible deployment solution, leading to even better scalability. Using the nepenthes platform we and several other organizations were able to greatly broaden the empirical basis of data available about self-replicating malware and provide thousands of samples of previously unknown malware to vendors of host-based IDS/anti-virus systems. This greatly improves the detection rate of this kind of threat.
Abstract:
Up to now, there is little empirically backed quantitative and qualitative knowledge about self-replicating malware publicly available. This hampers research in these topics because many counter-strategies against malware, e.g., network- and host-based intrusion detection systems, need hard empirical data to take full effect.
We present the nepenthes platform, a framework for large-scale collection of information on self-replicating malware in the wild. The basic principle of nepenthes is to emulate only the vulnerable parts of a service. This leads to an efficient and effective solution that offers many advantages compared to other honeypot-based solutions. Furthermore, nepenthes offers a flexible deployment solution, leading to even better scalability. Using the nepenthes platform we and several other organizations were able to greatly broaden the empirical basis of data available about self-replicating malware and provide thousands of samples of previously unknown malware to vendors of host-based IDS/anti-virus systems. This greatly improves the detection rate of this kind of threat.
@InProceedings{Baecher:2006:NPA,
author = {Paul Baecher and Markus Koetter and Thorsten Holz
and Maximillian Dornseif and Felix Freiling},
title = {{The Nepenthes Platform: An Efficient Approach to
Collect Malware}},
booktitle = {9th International Symposium On Recent Advances
In Intrusion Detection, RAID06, Hamburg, Germany,
September 20-22, 2006, Proceedings},
year = {2006},
series = {Lecture Notes in Computer Science 4219},
publisher = {Springer},
}
".
