Holdings: Virtual honeypots :: THWS Bibkatalog

Virtual honeypots: from botnet tracking to intrusion detection

Saved in:

Bibliographic Details
Main Authors:	Provos, Niels (Author), Holz, Thorsten (Author)
Format:	Book
Language:	English
Published:	Upper Saddle River, NJ [u.a.] Addison-Wesley 2008
Subjects:	Computer security Rechnernetz Wurm > Informatik Eindringerkennung
Online Access:	Table of contents only Inhaltsverzeichnis
Item Description:	Includes bibliographical references (p. 415-421) and index
Physical Description:	XXIII, 440 S. Ill.
ISBN:	0321336321 9780321336323

Staff View

MARC


LEADER	00000nam a2200000zc 4500
001	BV023201935
003	DE-604
005	20080314
007	t
008	080306s2008 xxua\|\|\| \|\|\|\| 00\|\|\| eng d
010			\|a 2007020022
020			\|a 0321336321 \|c pbk. : alk. paper \|9 0-321-33632-1
020			\|a 9780321336323 \|9 978-0-321-33632-3
035			\|a (OCoLC)128237865
035			\|a (DE-599)BVBBV023201935
040			\|a DE-604 \|b ger \|e aacr
041	0		\|a eng
044			\|a xxu \|c US
049			\|a DE-29T
050		0	\|a QA76.9.A25
082	0		\|a 005.8
100	1		\|a Provos, Niels \|e Verfasser \|4 aut
245	1	0	\|a Virtual honeypots \|b from botnet tracking to intrusion detection \|c Niels Provos ; Thorsten Holz
264		1	\|a Upper Saddle River, NJ [u.a.] \|b Addison-Wesley \|c 2008
300			\|a XXIII, 440 S. \|b Ill.
336			\|b txt \|2 rdacontent
337			\|b n \|2 rdamedia
338			\|b nc \|2 rdacarrier
500			\|a Includes bibliographical references (p. 415-421) and index
650		4	\|a Computer security
650	0	7	\|a Rechnernetz \|0 (DE-588)4070085-9 \|2 gnd \|9 rswk-swf
650	0	7	\|a Wurm \|g Informatik \|0 (DE-588)4779907-9 \|2 gnd \|9 rswk-swf
650	0	7	\|a Eindringerkennung \|0 (DE-588)4706627-1 \|2 gnd \|9 rswk-swf
689	0	0	\|a Rechnernetz \|0 (DE-588)4070085-9 \|D s
689	0	1	\|a Wurm \|g Informatik \|0 (DE-588)4779907-9 \|D s
689	0	2	\|a Eindringerkennung \|0 (DE-588)4706627-1 \|D s
689	0		\|5 DE-604
700	1		\|a Holz, Thorsten \|e Verfasser \|4 aut
856	4		\|u http://www.loc.gov/catdir/toc/ecip0718/2007020022.html \|3 Table of contents only
856	4	2	\|m OEBV Datenaustausch \|q application/pdf \|u http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=016388145&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA \|3 Inhaltsverzeichnis
999			\|a oai:aleph.bib-bvb.de:BVB01-016388145

Record in the Search Index

_version_	1804137479076315136
adam_text	* * * * * * * * * * PREFACE XTTL ACKNOWLEDGMENTS XXL ABOUT THE AUTHORS XXTTL 1 H O N E Y P O T AND N E T W O R K I N G B A C K G R O U N D 1 * 1.1 BRIEF TCP/IP INTRODUCTION 1* 1.2 HONEYPOT BACKGROUND 7* 1.2.1 HIGH-INTERACTION HONEYPOTS 9* 1.2.2 LOW-INTERACTION HONEYPOTS 10* 1.2.3 PHYSKAL HONEYPOTS 11* 1.2.4 VIRTUAL HONEYPOTS 11* 1.2.5 LEGAL ASPECTS 12* 1.3 TOOLS OF THE TRADE 13* 1.3.1 TCPDUMP 13* 1.3.2 WIRESHARK 15* 1.3.3 NMAP 16* 2 H I G H - I N T E R A C T I O N H O N E Y P O T S 19* 2.1 ADVANTAGES AND DISADVANTAGES 20* 2.2 VMWARE 22* 2.2.1 DIFFERENT VMWARE VERSIONS 25* 2.2.2 VIRTUAL NETWORK WITH VMWARE 26* 2.2.3 SETTING UP A VIRTUAL HIGH-INTERACTION HONEYPOT 29* 2.2.4 CREATING A VIRTUAL HONEYPOT 33* 2.2.5 ADDING ADDITIONAL MONITORING SOFTWARE 37* 2.2.6 CONNECTING THE VIRTUAL HONEYPOT TO THE INTERNET 39* 2.2.7 BUILDING A VIRTUAL HIGH-INTERACTION HONEYNET 40* 2.3 USER-MODE LINUX 41* 2.3.1 OVERVIEW 41* 2.3.2 INSTALLATION AND SETUP 42* V L L VIII C O N T E N T S 2.3.3 R U N T I M E FLAGS A N D C O N F I G U R A T I O N 4 6 * 2 . 3 . 4 M O N I T O R I N G U M L - B A S E D H O N E Y P O T S 5 0 * 2.3.5 C O N N E C T I N G T H E V I R T U A L H O N E Y P O T TO T H E I N T E R N E T 51* 2 . 3 . 6 B U I L D I N G A V I R T U A L H I G H - I N T E R A C T I O N H O N E Y N E T 52* 2.4 A R G O S 52* 2.4.1 O V E R V I E W 53* 2 . 4 . 2 I N S T A L L A T I O N A N D S E T U P F O R ARGOS H O N E Y P O T S 54* 2.5 S A F E G U A R D I N G Y O U R H O N E Y P O T S 62* 2.5.1 H O N E Y W A L L 63* 2 . 6 S U M M A R Y 69* 3 LOW-INTERACTION H O N E Y P O T S 71* 3.1 A D V A N T A G E S A N D D I S A D V A N T A G E S 72* 3.2 D E C E P T I O N T O O L K I T 73* 3.3 L A B R E A 74* 3.3.1 I N S T A L L A T I O N A N D S E T U P 75* 3.3.2 O B S E R V A T I O N S 81* 3.4 TINY H O N E Y P O T 81* 3.4.1 I N S T A L L A T I O N 82* 3.4.2 C A P T U R E LOGS 83* 3.4.3 SESSION LOGS 85* 3.4.4 N E T F I L T E R LOGS 85* 3.4.5 O B S E R V A T I O N S 86* 3.5 G H H - G O O G L E H A C K H O N E Y P O T 87* 3.5.1 G E N E R A L I N S T A L L A T I O N 87* 3.5.2 I N S T A L L I N G T H E T R A N S P A R E N T L I N K 91* 3.5.3 ACCESS L O G G I N G 92* 3 . 6 P H P . H O P - A W E B - B A S E D D E C E P T I O N F R A M E W O R K 94* 3.6.1 I N S T A L L A T I O N 95* 3.6.2 H I P H O P 96* 3.6.3 P H P M Y A D M I N 97* 3.7 S E C U R I N G Y O U R L O W - I N T E R A C T I O N H O N E Y P O T S 98* 3.7.1 C H R O O T J A I L 98* 3.7.2 S Y S T R A C E 101* 3 . 8 S U M M A R Y 103* 4 H O N E Y D - T H E BASICS 105* 4.1 O V E R V I E W 106* 4.1.1 F E A T U R E S 107* 4.1.2 I N S T A L L A T I O N A N D S E T U P 108* IX CONTENTS 4.2 DESIGN OVERVIEW 109* 4.2.1 INTERACTION ONLY VIA THE NETWORK 111* 4.2.2 MULTIPLE IP ADDRESSES 111* 4.2.3 DECEIVING FINGERPRINTING TOOLS 111* 4.3 RECEIVING NETWORK DATA 112* 4.4 RUNTIME FLAGS 114* 4.5 CONFIGURATION 115* 4.5.1 CREATE 117* 4.5.2 SET 117* 4.5.3 ADD 121* 4.5.4 BIND 123* 4.5.5 DELETE 124* 4.5.6 INCLUDE 125* 4.6 EXPERIMENTS WITH HONEYD 125* 4.6.1 EXPERIMENTING WITH HONEYD LOCALLY 125* 4.6.2 INTEGRATING VIRTUAL HONEYPOTS INTO PRODUCTION NETWORKS 128* 4.7 SERVICES 129* 4.8 LOGGING 131* 4.8.1 PACKET-LEVEL LOGGING 131* 4.8.2 SERVICE-LEVEL LOGGING 133* 4.9 SUMMARY 134* 5 HONEYD - ADVANCED TOPICS 135* 5.1 ADVANCED CONFIGURATION 136* 5.1.1 SET 136* 5.1.2 TARPIT 137* 5.1.3 ANNOTATE 138* 5.2 EMULATING SERVICES 139* 5.2.1 SCRIPTING LANGUAGES 139* 5.2.2 SMTP 139* 5.3 SUBSYSTEMS 142* 5.3.1 OPTIMIZING SUBSYSTEMS 145* 5.4 INTERNA! PYTHON SERVICES 146* 5.5 DYNAMIC TEMPLATES 148* 5.6 ROUTING TOPOLOGY 150* 5.7 HONEYDSTATS 154* 5.8 HONEYDCTL 156* 5.9 HONEYCOMB 158* 5.10 PERFORMANCE 160* 5.11 SUMMARY 161* X CANTENTS 6 COLLECTING MALWARE WITH HONEYPOTS 163* 6.1 A PRIMER ON MALICIOUS SOFTWARE 164* 6.2 NEPENTHES - A HONEYPOT SOLUTION TO CALLEET MALWARE 165* 6.2.1 AREHITEETUREOFNEPENTHES 167* 6.2.2 LIMITATIONS 176* 6.2.3 INSTALLATION AND SETUP 177* 6.2.4 CONFIGURATION 179* 6.2.5 COMMAND LINE FLAGS 181* 6.2.6 ASSIGNING MULTIPLE IP ADDRESSES 183* 6.2.7 FLEXIBLE DEPLOYMENT 185* 6.2.8 CAPTURING NEW EXPLOITS 186* 6.2.9 IMPLEMENTING VULNERABILITY MODULES 187* 6.2.10 RESULTS 188* 6.2.11 LESSONS LEARNED 196* 6.3 HONEYTRAP 197* 6.3.1 OVERVIEW 197* 6.3.2 INSTALLATION AND CONFIGURATION 200* 6.3.3 RUNNING HONEYTRAP 203* 6.4 OTHER HONEYPOT SOLUTIONS FOR LEARNING ABOUT MALWARE 204* 6.4.1 MULTIPOT 204* 6.4.2 HONEYBOT 205* 6.4.3 BILLY GOAT 205* 6.4.4 LEARNING ABAUT MALICIOUS NETWORK TRAFFIE 206* 6.5 SUMMARY 207* 7 HYBRID SYSTEMS 209* 7.1 COLLAPSAR 211* 7.2 POTEMKIN 214* 7.3 ROLEPLAYER 220* 7.4 RESEARCH SUMMARY 224* 7.5 BUILDING YOUR OWN HYBRID HONEYPOT SYSTEM 224* 7.5.1 NAT AND HIGH-INTERAETION HONEYPOTS 224* 7.5.2 HONEYD AND HIGH-INTERACTION HONEYPOT 228* 7.6 SUMMARY 230* 8 ELIENT HONEYPOTS 231* 8.1 LEARNING MORE ABOUT CLIENT-SIDE THREATS 232* 8.1.1 A CLOSER LOOK AT MS04-040 233* 8.1.2 OTHER TYPES OF CLIENT-SIDE ATTAEKS 236* 8.1.3 TOWARD CLIENT HONEYPOTS 238* 8.2 LOW-INTERAETION CLIENT HONEYPOTS 241* CONTENTS XL 8.2.1 LEARNING ABOUT MALICIOUS WEBSITES 241* 8.2.2 HONEYC 246* 8.3 HIGH-INTERACTION CLIENT HONEYPOTS 253* 8.3.1 DESIGN OFHIGH-INTERACTION CLIENT HONEYPOTS 254* 8.3.2 HONEYCLIENT 258* 8.3.3 CAPTURE-HPC 260* 8.3.4 HONEYMONKEY 262* 8.4 OTHER APPROACHES 263* 8.4.1 STUDYING SPYWARE ON THE INTERNET 264* 8.4.2 SPYBYE 267* 8.4.3 SITEADVISOR 270* 8.4.4 FURTHER RESEARCH 271* 8.5 SUMMARY 272* 9 DETECTING HONEYPOTS 273* 9.1 DETECTING LOW-INTERACTION HONEYPOTS 274* 9.2 DETECTING HIGH-INTERACTION HONEYPOTS 280* 9.2.1 DETECTING AND DISABLING SEBEK 281* 9.2.2 DETECTING THE HONEYWALL 285* 9.2.3 CIRCUMVENTING HONEYNET LOGGING 286* 9.2.4 VMWARE AND OTHER VIRTUAL MACHINES 289* 9.2.5 QEMU 297* 9.2.6 USER-MODE LINUX 298* 9.3 DETECTING ROOTKITS 302* 9.4 SUMMARY 305* 10 CASE STUDIES 307* 10.1 BLAST-O-MAT: USING NEPENTHES TO DETECT INFECTED CLIENTS 308* 10.1.1 MOTIVATION 309* 10.1.2 NEPENTHES AS PART OF AN INTRUSION DETECTION SYSTEM 311* 10.1.3 MITIGATION OFINFECTED SYSTEMS 312* 10.1.4 A MODERN TROJAN: HAXDOOR 316* 10.1.5 LESSONS LEARNED WITH BLAST-O-MAT 320* 10.1.6 LIGHTWEIGHT IDS BASED ON NEPENTHES 321* 10.1.7 SURFNET IDS 325* 10.2 SEARCH WORMS 327* 10.3 RED HAT 8.0 COMPROMISE 332* 10.3.1 ATTACK SUMMARY 334* 10.3.2 ATTACK TIMELINE 335* 10.3.3 TOOLS INVOLVED 338* 10.3.4 ATTACK EVALUATION 343* XII CONTENTS 10.4 WINDOWS 2000 COMPROMISE 343* 10.4.1 ATTACK SUMMARY 344* 10.4.2 ATTACK TIMELINE 345* 10.4.3 TOOLS INVOLVED 347* 10.4.4 ATTACK EVALUATION 350* 10.5 SUSE 9.1 COMPROMISE 351* 10.5.1 ATTACK SUMMARY 351* 10.5.2 ATTACK TIMELINE 352* 10.5.3 TOOLS INVOLVED 354* 10.5.4 ATTACK EVALUATION 356* 10.6 SUMMARY 357* 11 TRACKING BOTNETS 359* 11.1 BOT AND BOTNET 101 360* 11.1.1 EXAMPLES OFBOTS 362* 11.1.2 SPYWARE IN THE FORM OF BOTS 366* 11.1.3 BOTNET CONTROL STRUCTURE 369* 11.1.4 DDOS ATTACKS CAUSED BY BOTNETS 372* 11.2 TRACKING BOTNETS 373* 11.2.1 OBSERVING BOTNETS 375* 11.3 CASE STUDIES 376* 11.3.1 MOCBOT AND MS06-040 381* 11.3.2 OTHER OBSERVATIONS 384* 11.4 DEFENDING AGAINST BOTS 387* 11.5 SUMMARY 390* 12 ANALYZING MALWARE WITH CWSANDBOX 391* 12.1 CWSANDBOX OVERVIEW 392* 12.2 BEHAVIOR-BASED MALWARE ANALYSIS 394* 12.2.1 CODE ANALYSIS 394* 12.2.2 BEHAVIOR ANALYSIS 395* 12.2.3 API HOOKING 396* 12.2.4 CODE INJECTION 400* 12.3 CWSANDBOX - SYSTEM DESCRIPTION 401* 12.3.1 ARCHITECTURE 402* 12.4 RESULTS 405* 12.4.1 EXAMPLE ANALYSIS REPORT 406* 12.4.2 LARGE-SCALE ANALYSIS 411* 12.5 SUMMARY 413* BIBLIOGRAPHY 415* INDEX 423*
adam_txt	* * * * * * * * * * PREFACE XTTL ACKNOWLEDGMENTS XXL ABOUT THE AUTHORS XXTTL 1 H O N E Y P O T AND N E T W O R K I N G B A C K G R O U N D 1 * 1.1 BRIEF TCP/IP INTRODUCTION 1* 1.2 HONEYPOT BACKGROUND 7* 1.2.1 HIGH-INTERACTION HONEYPOTS 9* 1.2.2 LOW-INTERACTION HONEYPOTS 10* 1.2.3 PHYSKAL HONEYPOTS 11* 1.2.4 VIRTUAL HONEYPOTS 11* 1.2.5 LEGAL ASPECTS 12* 1.3 TOOLS OF THE TRADE 13* 1.3.1 TCPDUMP 13* 1.3.2 WIRESHARK 15* 1.3.3 NMAP 16* 2 H I G H - I N T E R A C T I O N H O N E Y P O T S 19* 2.1 ADVANTAGES AND DISADVANTAGES 20* 2.2 VMWARE 22* 2.2.1 DIFFERENT VMWARE VERSIONS 25* 2.2.2 VIRTUAL NETWORK WITH VMWARE 26* 2.2.3 SETTING UP A VIRTUAL HIGH-INTERACTION HONEYPOT 29* 2.2.4 CREATING A VIRTUAL HONEYPOT 33* 2.2.5 ADDING ADDITIONAL MONITORING SOFTWARE 37* 2.2.6 CONNECTING THE VIRTUAL HONEYPOT TO THE INTERNET 39* 2.2.7 BUILDING A VIRTUAL HIGH-INTERACTION HONEYNET 40* 2.3 USER-MODE LINUX 41* 2.3.1 OVERVIEW 41* 2.3.2 INSTALLATION AND SETUP 42* V L L VIII C O N T E N T S 2.3.3 R U N T I M E FLAGS A N D C O N F I G U R A T I O N 4 6 * 2 . 3 . 4 M O N I T O R I N G U M L - B A S E D H O N E Y P O T S 5 0 * 2.3.5 C O N N E C T I N G T H E V I R T U A L H O N E Y P O T TO T H E I N T E R N E T 51* 2 . 3 . 6 B U I L D I N G A V I R T U A L H I G H - I N T E R A C T I O N H O N E Y N E T 52* 2.4 A R G O S 52* 2.4.1 O V E R V I E W 53* 2 . 4 . 2 I N S T A L L A T I O N A N D S E T U P F O R ARGOS H O N E Y P O T S 54* 2.5 S A F E G U A R D I N G Y O U R H O N E Y P O T S 62* 2.5.1 H O N E Y W A L L 63* 2 . 6 S U M M A R Y 69* 3 LOW-INTERACTION H O N E Y P O T S 71* 3.1 A D V A N T A G E S A N D D I S A D V A N T A G E S 72* 3.2 D E C E P T I O N T O O L K I T 73* 3.3 L A B R E A 74* 3.3.1 I N S T A L L A T I O N A N D S E T U P 75* 3.3.2 O B S E R V A T I O N S 81* 3.4 TINY H O N E Y P O T 81* 3.4.1 I N S T A L L A T I O N 82* 3.4.2 C A P T U R E LOGS 83* 3.4.3 SESSION LOGS 85* 3.4.4 N E T F I L T E R LOGS 85* 3.4.5 O B S E R V A T I O N S 86* 3.5 G H H - G O O G L E H A C K H O N E Y P O T 87* 3.5.1 G E N E R A L I N S T A L L A T I O N 87* 3.5.2 I N S T A L L I N G T H E T R A N S P A R E N T L I N K 91* 3.5.3 ACCESS L O G G I N G 92* 3 . 6 P H P . H O P - A W E B - B A S E D D E C E P T I O N F R A M E W O R K 94* 3.6.1 I N S T A L L A T I O N 95* 3.6.2 H I P H O P 96* 3.6.3 P H P M Y A D M I N 97* 3.7 S E C U R I N G Y O U R L O W - I N T E R A C T I O N H O N E Y P O T S 98* 3.7.1 C H R O O T J A I L 98* 3.7.2 S Y S T R A C E 101* 3 . 8 S U M M A R Y 103* 4 H O N E Y D - T H E BASICS 105* 4.1 O V E R V I E W 106* 4.1.1 F E A T U R E S 107* 4.1.2 I N S T A L L A T I O N A N D S E T U P 108* IX CONTENTS 4.2 DESIGN OVERVIEW 109* 4.2.1 INTERACTION ONLY VIA THE NETWORK 111* 4.2.2 MULTIPLE IP ADDRESSES 111* 4.2.3 DECEIVING FINGERPRINTING TOOLS 111* 4.3 RECEIVING NETWORK DATA 112* 4.4 RUNTIME FLAGS 114* 4.5 CONFIGURATION 115* 4.5.1 CREATE 117* 4.5.2 SET 117* 4.5.3 ADD 121* 4.5.4 BIND 123* 4.5.5 DELETE 124* 4.5.6 INCLUDE 125* 4.6 EXPERIMENTS WITH HONEYD 125* 4.6.1 EXPERIMENTING WITH HONEYD LOCALLY 125* 4.6.2 INTEGRATING VIRTUAL HONEYPOTS INTO PRODUCTION NETWORKS 128* 4.7 SERVICES 129* 4.8 LOGGING 131* 4.8.1 PACKET-LEVEL LOGGING 131* 4.8.2 SERVICE-LEVEL LOGGING 133* 4.9 SUMMARY 134* 5 HONEYD - ADVANCED TOPICS 135* 5.1 ADVANCED CONFIGURATION 136* 5.1.1 SET 136* 5.1.2 TARPIT 137* 5.1.3 ANNOTATE 138* 5.2 EMULATING SERVICES 139* 5.2.1 SCRIPTING LANGUAGES 139* 5.2.2 SMTP 139* 5.3 SUBSYSTEMS 142* 5.3.1 OPTIMIZING SUBSYSTEMS 145* 5.4 INTERNA! PYTHON SERVICES 146* 5.5 DYNAMIC TEMPLATES 148* 5.6 ROUTING TOPOLOGY 150* 5.7 HONEYDSTATS 154* 5.8 HONEYDCTL 156* 5.9 HONEYCOMB 158* 5.10 PERFORMANCE 160* 5.11 SUMMARY 161* X CANTENTS 6 COLLECTING MALWARE WITH HONEYPOTS 163* 6.1 A PRIMER ON MALICIOUS SOFTWARE 164* 6.2 NEPENTHES - A HONEYPOT SOLUTION TO CALLEET MALWARE 165* 6.2.1 AREHITEETUREOFNEPENTHES 167* 6.2.2 LIMITATIONS 176* 6.2.3 INSTALLATION AND SETUP 177* 6.2.4 CONFIGURATION 179* 6.2.5 COMMAND LINE FLAGS 181* 6.2.6 ASSIGNING MULTIPLE IP ADDRESSES 183* 6.2.7 FLEXIBLE DEPLOYMENT 185* 6.2.8 CAPTURING NEW EXPLOITS 186* 6.2.9 IMPLEMENTING VULNERABILITY MODULES 187* 6.2.10 RESULTS 188* 6.2.11 LESSONS LEARNED 196* 6.3 HONEYTRAP 197* 6.3.1 OVERVIEW 197* 6.3.2 INSTALLATION AND CONFIGURATION 200* 6.3.3 RUNNING HONEYTRAP 203* 6.4 OTHER HONEYPOT SOLUTIONS FOR LEARNING ABOUT MALWARE 204* 6.4.1 MULTIPOT 204* 6.4.2 HONEYBOT 205* 6.4.3 BILLY GOAT 205* 6.4.4 LEARNING ABAUT MALICIOUS NETWORK TRAFFIE 206* 6.5 SUMMARY 207* 7 HYBRID SYSTEMS 209* 7.1 COLLAPSAR 211* 7.2 POTEMKIN 214* 7.3 ROLEPLAYER 220* 7.4 RESEARCH SUMMARY 224* 7.5 BUILDING YOUR OWN HYBRID HONEYPOT SYSTEM 224* 7.5.1 NAT AND HIGH-INTERAETION HONEYPOTS 224* 7.5.2 HONEYD AND HIGH-INTERACTION HONEYPOT 228* 7.6 SUMMARY 230* 8 ELIENT HONEYPOTS 231* 8.1 LEARNING MORE ABOUT CLIENT-SIDE THREATS 232* 8.1.1 A CLOSER LOOK AT MS04-040 233* 8.1.2 OTHER TYPES OF CLIENT-SIDE ATTAEKS 236* 8.1.3 TOWARD CLIENT HONEYPOTS 238* 8.2 LOW-INTERAETION CLIENT HONEYPOTS 241* CONTENTS XL 8.2.1 LEARNING ABOUT MALICIOUS WEBSITES 241* 8.2.2 HONEYC 246* 8.3 HIGH-INTERACTION CLIENT HONEYPOTS 253* 8.3.1 DESIGN OFHIGH-INTERACTION CLIENT HONEYPOTS 254* 8.3.2 HONEYCLIENT 258* 8.3.3 CAPTURE-HPC 260* 8.3.4 HONEYMONKEY 262* 8.4 OTHER APPROACHES 263* 8.4.1 STUDYING SPYWARE ON THE INTERNET 264* 8.4.2 SPYBYE 267* 8.4.3 SITEADVISOR 270* 8.4.4 FURTHER RESEARCH 271* 8.5 SUMMARY 272* 9 DETECTING HONEYPOTS 273* 9.1 DETECTING LOW-INTERACTION HONEYPOTS 274* 9.2 DETECTING HIGH-INTERACTION HONEYPOTS 280* 9.2.1 DETECTING AND DISABLING SEBEK 281* 9.2.2 DETECTING THE HONEYWALL 285* 9.2.3 CIRCUMVENTING HONEYNET LOGGING 286* 9.2.4 VMWARE AND OTHER VIRTUAL MACHINES 289* 9.2.5 QEMU 297* 9.2.6 USER-MODE LINUX 298* 9.3 DETECTING ROOTKITS 302* 9.4 SUMMARY 305* 10 CASE STUDIES 307* 10.1 BLAST-O-MAT: USING NEPENTHES TO DETECT INFECTED CLIENTS 308* 10.1.1 MOTIVATION 309* 10.1.2 NEPENTHES AS PART OF AN INTRUSION DETECTION SYSTEM 311* 10.1.3 MITIGATION OFINFECTED SYSTEMS 312* 10.1.4 A MODERN TROJAN: HAXDOOR 316* 10.1.5 LESSONS LEARNED WITH BLAST-O-MAT 320* 10.1.6 LIGHTWEIGHT IDS BASED ON NEPENTHES 321* 10.1.7 SURFNET IDS 325* 10.2 SEARCH WORMS 327* 10.3 RED HAT 8.0 COMPROMISE 332* 10.3.1 ATTACK SUMMARY 334* 10.3.2 ATTACK TIMELINE 335* 10.3.3 TOOLS INVOLVED 338* 10.3.4 ATTACK EVALUATION 343* XII CONTENTS 10.4 WINDOWS 2000 COMPROMISE 343* 10.4.1 ATTACK SUMMARY 344* 10.4.2 ATTACK TIMELINE 345* 10.4.3 TOOLS INVOLVED 347* 10.4.4 ATTACK EVALUATION 350* 10.5 SUSE 9.1 COMPROMISE 351* 10.5.1 ATTACK SUMMARY 351* 10.5.2 ATTACK TIMELINE 352* 10.5.3 TOOLS INVOLVED 354* 10.5.4 ATTACK EVALUATION 356* 10.6 SUMMARY 357* 11 TRACKING BOTNETS 359* 11.1 BOT AND BOTNET 101 360* 11.1.1 EXAMPLES OFBOTS 362* 11.1.2 SPYWARE IN THE FORM OF BOTS 366* 11.1.3 BOTNET CONTROL STRUCTURE 369* 11.1.4 DDOS ATTACKS CAUSED BY BOTNETS 372* 11.2 TRACKING BOTNETS 373* 11.2.1 OBSERVING BOTNETS 375* 11.3 CASE STUDIES 376* 11.3.1 MOCBOT AND MS06-040 381* 11.3.2 OTHER OBSERVATIONS 384* 11.4 DEFENDING AGAINST BOTS 387* 11.5 SUMMARY 390* 12 ANALYZING MALWARE WITH CWSANDBOX 391* 12.1 CWSANDBOX OVERVIEW 392* 12.2 BEHAVIOR-BASED MALWARE ANALYSIS 394* 12.2.1 CODE ANALYSIS 394* 12.2.2 BEHAVIOR ANALYSIS 395* 12.2.3 API HOOKING 396* 12.2.4 CODE INJECTION 400* 12.3 CWSANDBOX - SYSTEM DESCRIPTION 401* 12.3.1 ARCHITECTURE 402* 12.4 RESULTS 405* 12.4.1 EXAMPLE ANALYSIS REPORT 406* 12.4.2 LARGE-SCALE ANALYSIS 411* 12.5 SUMMARY 413* BIBLIOGRAPHY 415* INDEX 423*
any_adam_object	1
any_adam_object_boolean	1
author	Provos, Niels Holz, Thorsten
author_facet	Provos, Niels Holz, Thorsten
author_role	aut aut
author_sort	Provos, Niels
author_variant	n p np t h th
building	Verbundindex
bvnumber	BV023201935
callnumber-first	Q - Science
callnumber-label	QA76
callnumber-raw	QA76.9.A25
callnumber-search	QA76.9.A25
callnumber-sort	QA 276.9 A25
callnumber-subject	QA - Mathematics
ctrlnum	(OCoLC)128237865 (DE-599)BVBBV023201935
dewey-full	005.8
dewey-hundreds	000 - Computer science, information, general works
dewey-ones	005 - Computer programming, programs, data, security
dewey-raw	005.8
dewey-search	005.8
dewey-sort	15.8
dewey-tens	000 - Computer science, information, general works
discipline	Informatik
discipline_str_mv	Informatik
format	Book
fullrecord	<?xml version="1.0" encoding="UTF-8"?><collection xmlns="http://www.loc.gov/MARC21/slim"><record><leader>01805nam a2200457zc 4500</leader><controlfield tag="001">BV023201935</controlfield><controlfield tag="003">DE-604</controlfield><controlfield tag="005">20080314 </controlfield><controlfield tag="007">t</controlfield><controlfield tag="008">080306s2008 xxua\|\|\| \|\|\|\| 00\|\|\| eng d</controlfield><datafield tag="010" ind1=" " ind2=" "><subfield code="a">2007020022</subfield></datafield><datafield tag="020" ind1=" " ind2=" "><subfield code="a">0321336321</subfield><subfield code="c">pbk. : alk. paper</subfield><subfield code="9">0-321-33632-1</subfield></datafield><datafield tag="020" ind1=" " ind2=" "><subfield code="a">9780321336323</subfield><subfield code="9">978-0-321-33632-3</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(OCoLC)128237865</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(DE-599)BVBBV023201935</subfield></datafield><datafield tag="040" ind1=" " ind2=" "><subfield code="a">DE-604</subfield><subfield code="b">ger</subfield><subfield code="e">aacr</subfield></datafield><datafield tag="041" ind1="0" ind2=" "><subfield code="a">eng</subfield></datafield><datafield tag="044" ind1=" " ind2=" "><subfield code="a">xxu</subfield><subfield code="c">US</subfield></datafield><datafield tag="049" ind1=" " ind2=" "><subfield code="a">DE-29T</subfield></datafield><datafield tag="050" ind1=" " ind2="0"><subfield code="a">QA76.9.A25</subfield></datafield><datafield tag="082" ind1="0" ind2=" "><subfield code="a">005.8</subfield></datafield><datafield tag="100" ind1="1" ind2=" "><subfield code="a">Provos, Niels</subfield><subfield code="e">Verfasser</subfield><subfield code="4">aut</subfield></datafield><datafield tag="245" ind1="1" ind2="0"><subfield code="a">Virtual honeypots</subfield><subfield code="b">from botnet tracking to intrusion detection</subfield><subfield code="c">Niels Provos ; Thorsten Holz</subfield></datafield><datafield tag="264" ind1=" " ind2="1"><subfield code="a">Upper Saddle River, NJ [u.a.]</subfield><subfield code="b">Addison-Wesley</subfield><subfield code="c">2008</subfield></datafield><datafield tag="300" ind1=" " ind2=" "><subfield code="a">XXIII, 440 S.</subfield><subfield code="b">Ill.</subfield></datafield><datafield tag="336" ind1=" " ind2=" "><subfield code="b">txt</subfield><subfield code="2">rdacontent</subfield></datafield><datafield tag="337" ind1=" " ind2=" "><subfield code="b">n</subfield><subfield code="2">rdamedia</subfield></datafield><datafield tag="338" ind1=" " ind2=" "><subfield code="b">nc</subfield><subfield code="2">rdacarrier</subfield></datafield><datafield tag="500" ind1=" " ind2=" "><subfield code="a">Includes bibliographical references (p. 415-421) and index</subfield></datafield><datafield tag="650" ind1=" " ind2="4"><subfield code="a">Computer security</subfield></datafield><datafield tag="650" ind1="0" ind2="7"><subfield code="a">Rechnernetz</subfield><subfield code="0">(DE-588)4070085-9</subfield><subfield code="2">gnd</subfield><subfield code="9">rswk-swf</subfield></datafield><datafield tag="650" ind1="0" ind2="7"><subfield code="a">Wurm</subfield><subfield code="g">Informatik</subfield><subfield code="0">(DE-588)4779907-9</subfield><subfield code="2">gnd</subfield><subfield code="9">rswk-swf</subfield></datafield><datafield tag="650" ind1="0" ind2="7"><subfield code="a">Eindringerkennung</subfield><subfield code="0">(DE-588)4706627-1</subfield><subfield code="2">gnd</subfield><subfield code="9">rswk-swf</subfield></datafield><datafield tag="689" ind1="0" ind2="0"><subfield code="a">Rechnernetz</subfield><subfield code="0">(DE-588)4070085-9</subfield><subfield code="D">s</subfield></datafield><datafield tag="689" ind1="0" ind2="1"><subfield code="a">Wurm</subfield><subfield code="g">Informatik</subfield><subfield code="0">(DE-588)4779907-9</subfield><subfield code="D">s</subfield></datafield><datafield tag="689" ind1="0" ind2="2"><subfield code="a">Eindringerkennung</subfield><subfield code="0">(DE-588)4706627-1</subfield><subfield code="D">s</subfield></datafield><datafield tag="689" ind1="0" ind2=" "><subfield code="5">DE-604</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Holz, Thorsten</subfield><subfield code="e">Verfasser</subfield><subfield code="4">aut</subfield></datafield><datafield tag="856" ind1="4" ind2=" "><subfield code="u">http://www.loc.gov/catdir/toc/ecip0718/2007020022.html</subfield><subfield code="3">Table of contents only</subfield></datafield><datafield tag="856" ind1="4" ind2="2"><subfield code="m">OEBV Datenaustausch</subfield><subfield code="q">application/pdf</subfield><subfield code="u">http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=016388145&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA</subfield><subfield code="3">Inhaltsverzeichnis</subfield></datafield><datafield tag="999" ind1=" " ind2=" "><subfield code="a">oai:aleph.bib-bvb.de:BVB01-016388145</subfield></datafield></record></collection>
id	DE-604.BV023201935
illustrated	Illustrated
index_date	2024-07-02T20:08:28Z
indexdate	2024-07-09T21:12:57Z
institution	BVB
isbn	0321336321 9780321336323
language	English
lccn	2007020022
oai_aleph_id	oai:aleph.bib-bvb.de:BVB01-016388145
oclc_num	128237865
open_access_boolean
owner	DE-29T
owner_facet	DE-29T
physical	XXIII, 440 S. Ill.
publishDate	2008
publishDateSearch	2008
publishDateSort	2008
publisher	Addison-Wesley
record_format	marc
spelling	Provos, Niels Verfasser aut Virtual honeypots from botnet tracking to intrusion detection Niels Provos ; Thorsten Holz Upper Saddle River, NJ [u.a.] Addison-Wesley 2008 XXIII, 440 S. Ill. txt rdacontent n rdamedia nc rdacarrier Includes bibliographical references (p. 415-421) and index Computer security Rechnernetz (DE-588)4070085-9 gnd rswk-swf Wurm Informatik (DE-588)4779907-9 gnd rswk-swf Eindringerkennung (DE-588)4706627-1 gnd rswk-swf Rechnernetz (DE-588)4070085-9 s Wurm Informatik (DE-588)4779907-9 s Eindringerkennung (DE-588)4706627-1 s DE-604 Holz, Thorsten Verfasser aut http://www.loc.gov/catdir/toc/ecip0718/2007020022.html Table of contents only OEBV Datenaustausch application/pdf http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=016388145&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA Inhaltsverzeichnis
spellingShingle	Provos, Niels Holz, Thorsten Virtual honeypots from botnet tracking to intrusion detection Computer security Rechnernetz (DE-588)4070085-9 gnd Wurm Informatik (DE-588)4779907-9 gnd Eindringerkennung (DE-588)4706627-1 gnd
subject_GND	(DE-588)4070085-9 (DE-588)4779907-9 (DE-588)4706627-1
title	Virtual honeypots from botnet tracking to intrusion detection
title_auth	Virtual honeypots from botnet tracking to intrusion detection
title_exact_search	Virtual honeypots from botnet tracking to intrusion detection
title_exact_search_txtP	Virtual honeypots from botnet tracking to intrusion detection
title_full	Virtual honeypots from botnet tracking to intrusion detection Niels Provos ; Thorsten Holz
title_fullStr	Virtual honeypots from botnet tracking to intrusion detection Niels Provos ; Thorsten Holz
title_full_unstemmed	Virtual honeypots from botnet tracking to intrusion detection Niels Provos ; Thorsten Holz
title_short	Virtual honeypots
title_sort	virtual honeypots from botnet tracking to intrusion detection
title_sub	from botnet tracking to intrusion detection
topic	Computer security Rechnernetz (DE-588)4070085-9 gnd Wurm Informatik (DE-588)4779907-9 gnd Eindringerkennung (DE-588)4706627-1 gnd
topic_facet	Computer security Rechnernetz Wurm Informatik Eindringerkennung
url	http://www.loc.gov/catdir/toc/ecip0718/2007020022.html http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=016388145&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA
work_keys_str_mv	AT provosniels virtualhoneypotsfrombotnettrackingtointrusiondetection AT holzthorsten virtualhoneypotsfrombotnettrackingtointrusiondetection

Holdings

There is no print copy available.

Interlibrary loan Place Request Caution: Not in THWS collection! Indexes

MARC

Record in the Search Index

There is no print copy available.

Similar Items