SlideShare une entreprise Scribd logo

Building an IP Reputation Engine: Tracking the Miscreants

•
•
AlienVault
AlienVault

The AlienVault Open Threat Exchange™ (AV-OTX™) is a system for sharing threat intelligence among OSSIM users and AlienVault customers. Go behind the scenes and find out how it works!

Technologie
1  sur  38
Building an IP Reputation engine Tracking the miscreants
Index 1. What is IP Reputation 2. Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 5. Current integrations
Index 1. What is IP Reputation 1.1. The problem 1.2. What is IP Reputation? 1.3. What is an IP Reputation engine? 1.4. Features of an IP Reputation engine 2. Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 5. Current integrations
The problem Security analyst: “How many of my network connections are going to bad sites?”
What is IP Reputation? IP Reputation is a summary of the past behavior activity detected on an IP An IP with reputation information add context when a network connection is observed
What is an IP Reputation engine? An IP Reputation engine is a system to classify and score large sets of IPs, in low or high reputation
Features of an IP Reputation engine Updated information Accurate values associated to every IP Assign activity classification to every IP Range of detection
Index 1. What is IP Reputation 2. Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 5. Current integrations
Open Source IP Reputation Portal http://labs.alienvault.com/labs/index.php/projects/open-source-ip-reputation-portal/
A register in the reputation.data file: <IP>#<RELIABILITY>#<RISK>#<ACTIVITY>#<COUNTRY>#<CITY>#<LAT>,<LON> 1...10 1...10 C&C Open Proxy Malicious Host Phishing Malware Domain Spamming Malware IP Scanning Host 64.44.240.225#4#3#Malicious Host#US#Chicago#41.9287986755,-87.6315002441 194.176.176.82#4#2#Spamming#RO#Bucharest#44.4333000183,26.1000003815 93.183.203.41#3#2#C&C;Malware Domain#UA#Kiev#50.4333000183,30.5167007446 64.141.101.204#1#2#Malware Domain#CA#Calgary#51.0833015442,-114.083297729 https://reputation.alienvault.com/reputation.data
Index 1. What is IP Reputation 2. Open Source IP Reputation Portal 3. How is the engine 3.1. Architecture design 3.1.1. Server 3.1.2. Agent 3.1.3. URL system 3.2. Scoring system 4. Feeding the engine
Architecture design Server Database Prefilter URL system Agent IPs/domains URLs Agent DATA IP reputation portal
Scoring system DNSBL + BULK DOMAINS + DYNAMIC IP DYNAMIC DNS + GOOGLE SAFE BROWSING + FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
Scoring system DNSBL + $ host 6.6.6.6.zen.spamhaus.org Host 6.6.6.6.zen.spamhaus.org not BULK DOMAINS + found: 3(NXDOMAIN) DYNAMIC IP $ host 2.0.0.127.zen.spamhaus.org 2.0.0.127.zen.spamhaus.org has DYNAMIC DNS + address 127.0.0.10 2.0.0.127.zen.spamhaus.org has address 127.0.0.2 GOOGLE SAFE BROWSING + 2.0.0.127.zen.spamhaus.org has address 127.0.0.4 FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
Scoring system DNSBL + *.co.be BULK DOMAINS + *.co.cc *.co.com.au DYNAMIC IP *.co.tv *.com.ua DYNAMIC DNS + *.cu.cc GOOGLE SAFE BROWSING + *.cw.cm *.cx.cc FILE-SHARING IP - *.cz.cc ALEXA TOP ONE MILLION - *.cz.tf HEURISTIC DOMAIN +
Scoring system DNSBL + BULK DOMAINS + $ host 87.216.x.x DYNAMIC IP x.x.216.87.in-addr.arpa domain name pointer x.x.216.87.dynamic.jazztel.es. DYNAMIC DNS + GOOGLE SAFE BROWSING + FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
Scoring system DNSBL + BULK DOMAINS + *.ath.cx DYNAMIC IP *.dyndns.org DYNAMIC DNS + *.no-ip.biz *.no-ip.info GOOGLE SAFE BROWSING + *.no-ip.org FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
Scoring system DNSBL + BULK DOMAINS + DYNAMIC IP DYNAMIC DNS + GOOGLE SAFE BROWSING + FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
Scoring system DNSBL + BULK DOMAINS + DYNAMIC IP DYNAMIC DNS + GOOGLE SAFE BROWSING + FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
Scoring system DNSBL + BULK DOMAINS + 1, google.com DYNAMIC IP 2, facebook.com 3, youtube.com 4, yahoo.com DYNAMIC DNS + 5, baidu.com 6, wikipedia.org GOOGLE SAFE BROWSING + 7, live.com 8, blogspot.com 9, amazon.com FILE-SHARING IP - 10, twitter.com ... ALEXA TOP ONE MILLION - 999999, panciapiatta.net 1000000, acsysun.co.jp HEURISTIC DOMAIN +
Scoring system DNSBL + BULK DOMAINS + ypyfp.com.tw jlmjalzjk.gs ewdkddr.me DYNAMIC IP xzasuf.com.pt nnis.co.uk DYNAMIC DNS + qzlx.co.za tuxs.com.ua GOOGLE SAFE BROWSING + upwcbab.tw hkwytkey.pe uzabfgqfk.my FILE-SHARING IP - http://labs.alienvault.com/labs/ index.php/2012/detecting-malware- ALEXA TOP ONE MILLION - domains-by-syntax-heuristics/ HEURISTIC DOMAIN +
Index 1. What is IP Reputation 2. Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 4.1. External sources 4.2. Our sandnet 4.3. AlienVault OTX 5. Current integrations
Getting data from external sources { Malware Trackers Malicious Hosts lists Open Proxy lists Scanning Hosts lists SPAM Trackers and more...
Our sandnet Samples Queue Sandbox Sandnet web panel Sandnet { } Database Traffic, rules trigger Traffic, no rules trigger No traffic! IP Reputation Database
AlienVault OTX is a system for sharing threat intelligence among OSSIM users and AlienVault customers. http://www.alienvault.com/alienvault-labs/open- threat-exchange/
Index 1. What is IP Reputation 2. What is the Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 5. Current integrations 5.1. Integration in OSSIM 5.2. Other integrations
Integration in OSSIM OSSIM is an Open Source SIEM (Security Information Event Management). A comprehensive compilation of tools that work together to provide a detailed view over each and every aspect of your networks, hosts, physical access devices, server, etc. http://communities.alienvault.com/community A security event manager (SEM) (acronyms SIEM and SIM) is a computerized tool used on enterprise data networks to centralize the storage and interpretation of logs, or events, generated by other software running on the network. http://en.wikipedia.org/wiki/Security_event_manager
{ fprobe, nfSen (flow collector and analyzer) Snort (IDS) + EmergingThreats ruleset OSSEC (HIDS) Nagios (service and infrastructure monitoring) OpenVAS, Nessus (vulnerability assessment) p0f, PADS, arpwatch (passive network monitoring) nmap (network scanning) OCS Inventory NG (host-based inventory) Wireshark, tcpdump (full packet capture) and more...
{ data collection with plugins: routers, firewalls, switches... load balancers, intrusion prevention systems honeypots, web proxies, web application firewalls ...
OSSIM architecture Find patterns Server Correlation engine Insert events Normalized data Sensors Database Detects new data DATA
Logic correlation if detected firewall or proxy event + and is an ACCEPT or HTTP code 200 OK event + and the destination IP has a low reputation = alarm <directive id="29001" name="Suspicious communication on SRC_IP" priority="5"> <rule type="detector" name="HTTP connection to low IP reputation destination" plugin_id="1503" plugin_sid="1" reliability="10" occurrence="1" from="HOME_NET" to="!HOME_NET" port_from="ANY" port_to="80,443" to_reputation="true" protocol="TCP"/> </directive>
Logic correlation
Other integrations Snort reputation format Iptables format Squid format Unix (hosts.deny) format More to come: shellscripts, configuration guides, nfSen plugin...
Future of the IP reputation Live scoring API Predictive IP reputation Extent to domain blocklist
Conclusions 1. Free to use IP Reputation database 2. Detailed information about the activity and history of every IP through the web portal 3. Continuously updated and maintained using different resources and improved with AlienVault OTX 4. Fully integrated in OSSIM, ready to be easily integrated with another systems
http://labs.alienvault.com Alberto Ortega Guillermo Grande a0rtega Guillermo aortega@alienvault.com ggrande@alienvault.com

Recommandé

Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onSplunk
 
Metasploitable
MetasploitableMetasploitable
MetasploitableSri Manakula Vinayagar Engineering College
 
Splunk Enterprise Security
Splunk Enterprise SecuritySplunk Enterprise Security
Splunk Enterprise SecuritySplunk
 
Bsides SP 2022 - EPSS - Final.pptx
Bsides SP 2022 - EPSS - Final.pptxBsides SP 2022 - EPSS - Final.pptx
Bsides SP 2022 - EPSS - Final.pptxClavis Segurança da Informação
 
Configuring Data Sources in AlienVault
Configuring Data Sources in AlienVaultConfiguring Data Sources in AlienVault
Configuring Data Sources in AlienVaultAlienVault
 
Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS Brent Muir
 
Présentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo WazuhPrésentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo WazuhAurélie Henriot
 
Splunk-Presentation
Splunk-Presentation Splunk-Presentation
Splunk-Presentation PrasadThorat23
 

Recommandé

Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onSplunk
 
Metasploitable
MetasploitableMetasploitable
MetasploitableSri Manakula Vinayagar Engineering College
 
Splunk Enterprise Security
Splunk Enterprise SecuritySplunk Enterprise Security
Splunk Enterprise SecuritySplunk
 
Bsides SP 2022 - EPSS - Final.pptx
Bsides SP 2022 - EPSS - Final.pptxBsides SP 2022 - EPSS - Final.pptx
Bsides SP 2022 - EPSS - Final.pptxClavis Segurança da Informação
 
Configuring Data Sources in AlienVault
Configuring Data Sources in AlienVaultConfiguring Data Sources in AlienVault
Configuring Data Sources in AlienVaultAlienVault
 
Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS Brent Muir
 
Présentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo WazuhPrésentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo WazuhAurélie Henriot
 
Splunk-Presentation
Splunk-Presentation Splunk-Presentation
Splunk-Presentation PrasadThorat23
 
Présentation et démo ELK/SIEM/Wazuh
Présentation et démo ELK/SIEM/Wazuh Présentation et démo ELK/SIEM/Wazuh
Présentation et démo ELK/SIEM/Wazuh clevernetsystemsgeneva
 
Metasploit framwork
Metasploit framworkMetasploit framwork
Metasploit framworkDeepanshu Gajbhiye
 
Cloud Privacy & Security compliance
Cloud Privacy & Security complianceCloud Privacy & Security compliance
Cloud Privacy & Security complianceBryan Starbuck
 
Snort
SnortSnort
SnortStickman Hai
 
Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)LJ PROJECTS
 
Alphorm.com Formation Splunk : Maitriser les fondamentaux
Alphorm.com Formation Splunk : Maitriser les fondamentauxAlphorm.com Formation Splunk : Maitriser les fondamentaux
Alphorm.com Formation Splunk : Maitriser les fondamentauxAlphorm
 
Analytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopAnalytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopSplunk
 
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...Mauricio Velazco
 
Building active directory lab for red teaming
Building active directory lab for red teamingBuilding active directory lab for red teaming
Building active directory lab for red teamingn|u - The Open Security Community
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber worldAkash Sarode
 
Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]RootedCON
 
IDS and IPS
IDS and IPSIDS and IPS
IDS and IPSSantosh Khadsare
 
Splunk Overview
Splunk OverviewSplunk Overview
Splunk OverviewSplunk
 
Nessus Software
Nessus SoftwareNessus Software
Nessus SoftwareMegha Sahu
 
The Indicators of Compromise
The Indicators of CompromiseThe Indicators of Compromise
The Indicators of CompromiseTomasz Jakubowski
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
20210906-Nessus-FundamentalInfoSec.ppsx
20210906-Nessus-FundamentalInfoSec.ppsx20210906-Nessus-FundamentalInfoSec.ppsx
20210906-Nessus-FundamentalInfoSec.ppsxSuman Garai
 
Vulnerability Assessment Report
Vulnerability Assessment ReportVulnerability Assessment Report
Vulnerability Assessment ReportHarshit Singh Bhatia
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshopArpan Raval
 
Nmap basics
Nmap basicsNmap basics
Nmap basicsn|u - The Open Security Community
 
Defcon
DefconDefcon
DefconOpenDNS
 
Leveraging DNS to Surface Attacker Activity
Leveraging DNS to Surface Attacker ActivityLeveraging DNS to Surface Attacker Activity
Leveraging DNS to Surface Attacker ActivitySqrrl
 

Contenu connexe

Tendances

Présentation et démo ELK/SIEM/Wazuh
Présentation et démo ELK/SIEM/Wazuh Présentation et démo ELK/SIEM/Wazuh
Présentation et démo ELK/SIEM/Wazuh clevernetsystemsgeneva
 
Cloud Privacy & Security compliance
Cloud Privacy & Security complianceCloud Privacy & Security compliance
Cloud Privacy & Security complianceBryan Starbuck
 
Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)LJ PROJECTS
 
Alphorm.com Formation Splunk : Maitriser les fondamentaux
Alphorm.com Formation Splunk : Maitriser les fondamentauxAlphorm.com Formation Splunk : Maitriser les fondamentaux
Alphorm.com Formation Splunk : Maitriser les fondamentauxAlphorm
 
Analytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopAnalytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopSplunk
 
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...Mauricio Velazco
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber worldAkash Sarode
 
Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]RootedCON
 
Splunk Overview
Splunk OverviewSplunk Overview
Splunk OverviewSplunk
 
Nessus Software
Nessus SoftwareNessus Software
Nessus SoftwareMegha Sahu
 
The Indicators of Compromise
The Indicators of CompromiseThe Indicators of Compromise
The Indicators of CompromiseTomasz Jakubowski
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
20210906-Nessus-FundamentalInfoSec.ppsx
20210906-Nessus-FundamentalInfoSec.ppsx20210906-Nessus-FundamentalInfoSec.ppsx
20210906-Nessus-FundamentalInfoSec.ppsxSuman Garai
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshopArpan Raval
 

Tendances (20)

Présentation et démo ELK/SIEM/Wazuh
Présentation et démo ELK/SIEM/Wazuh Présentation et démo ELK/SIEM/Wazuh
Présentation et démo ELK/SIEM/Wazuh
 
Metasploit framwork
Metasploit framworkMetasploit framwork
Metasploit framwork
 
Cloud Privacy & Security compliance
Cloud Privacy & Security complianceCloud Privacy & Security compliance
Cloud Privacy & Security compliance
 
Snort
SnortSnort
Snort
 
Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)
 
Alphorm.com Formation Splunk : Maitriser les fondamentaux
Alphorm.com Formation Splunk : Maitriser les fondamentauxAlphorm.com Formation Splunk : Maitriser les fondamentaux
Alphorm.com Formation Splunk : Maitriser les fondamentaux
 
Analytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopAnalytics Driven SIEM Workshop
Analytics Driven SIEM Workshop
 
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
 
Building active directory lab for red teaming
Building active directory lab for red teamingBuilding active directory lab for red teaming
Building active directory lab for red teaming
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber world
 
Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]
 
IDS and IPS
IDS and IPSIDS and IPS
IDS and IPS
 
Splunk Overview
Splunk OverviewSplunk Overview
Splunk Overview
 
Nessus Software
Nessus SoftwareNessus Software
Nessus Software
 
The Indicators of Compromise
The Indicators of CompromiseThe Indicators of Compromise
The Indicators of Compromise
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
 
20210906-Nessus-FundamentalInfoSec.ppsx
20210906-Nessus-FundamentalInfoSec.ppsx20210906-Nessus-FundamentalInfoSec.ppsx
20210906-Nessus-FundamentalInfoSec.ppsx
 
Vulnerability Assessment Report
Vulnerability Assessment ReportVulnerability Assessment Report
Vulnerability Assessment Report
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshop
 
Nmap basics
Nmap basicsNmap basics
Nmap basics
 

Similaire à Building an IP Reputation Engine: Tracking the Miscreants

Leveraging DNS to Surface Attacker Activity
Leveraging DNS to Surface Attacker ActivityLeveraging DNS to Surface Attacker Activity
Leveraging DNS to Surface Attacker ActivitySqrrl
 
Minieri CS6262 Project Poster
Minieri CS6262 Project PosterMinieri CS6262 Project Poster
Minieri CS6262 Project PosterJoe Minieri
 
New DNS Traffic Analysis Techniques to Identify Global Internet Threats
New DNS Traffic Analysis Techniques to Identify Global Internet ThreatsNew DNS Traffic Analysis Techniques to Identify Global Internet Threats
New DNS Traffic Analysis Techniques to Identify Global Internet ThreatsOpenDNS
 
Apache Directory and the OSGi Service Platform - Enrique Rodriguez, PMC Membe...
Apache Directory and the OSGi Service Platform - Enrique Rodriguez, PMC Membe...Apache Directory and the OSGi Service Platform - Enrique Rodriguez, PMC Membe...
Apache Directory and the OSGi Service Platform - Enrique Rodriguez, PMC Membe...mfrancis
 
Automate or die! Rootedcon 2017
Automate or die! Rootedcon 2017Automate or die! Rootedcon 2017
Automate or die! Rootedcon 2017Toni de la Fuente
 
Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...
Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...
Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...RootedCON
 
DNSSEC Tutorial, by Champika Wijayatunga [APNIC 38]
DNSSEC Tutorial, by Champika Wijayatunga [APNIC 38]DNSSEC Tutorial, by Champika Wijayatunga [APNIC 38]
DNSSEC Tutorial, by Champika Wijayatunga [APNIC 38]APNIC
 
Orchestrating Docker with Terraform and Consul by Mitchell Hashimoto
Orchestrating Docker with Terraform and Consul by Mitchell Hashimoto Orchestrating Docker with Terraform and Consul by Mitchell Hashimoto
Orchestrating Docker with Terraform and Consul by Mitchell Hashimoto Docker, Inc.
 
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...OpenDNS
 
ICANN 51: Name Collision
ICANN 51: Name CollisionICANN 51: Name Collision
ICANN 51: Name CollisionICANN
 
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...RootedCON
 
DNS как линия защиты/DNS as a Defense Vector
DNS как линия защиты/DNS as a Defense VectorDNS как линия защиты/DNS as a Defense Vector
DNS как линия защиты/DNS as a Defense VectorPositive Hack Days
 
HSB - Secure DNS en BGP ontwikkelingen - Benno Overeinder
HSB - Secure DNS en BGP ontwikkelingen - Benno OvereinderHSB - Secure DNS en BGP ontwikkelingen - Benno Overeinder
HSB - Secure DNS en BGP ontwikkelingen - Benno OvereinderSplend
 
DNS for Developers - NDC Oslo 2016
DNS for Developers - NDC Oslo 2016DNS for Developers - NDC Oslo 2016
DNS for Developers - NDC Oslo 2016Maarten Balliauw
 
DEF CON 27 - TRAVIS PALMER - first try dns cache poisoning with ipv4 and ipv6...
DEF CON 27 - TRAVIS PALMER - first try dns cache poisoning with ipv4 and ipv6...DEF CON 27 - TRAVIS PALMER - first try dns cache poisoning with ipv4 and ipv6...
DEF CON 27 - TRAVIS PALMER - first try dns cache poisoning with ipv4 and ipv6...Felipe Prado
 
AWS User Group - Perth - April 2021 - DNS
AWS User Group - Perth - April 2021 - DNSAWS User Group - Perth - April 2021 - DNS
AWS User Group - Perth - April 2021 - DNSJames Bromberger
 
MultiCloud Bursting from Openstack to Windows Azure and Amazon AWS with Righ...
MultiCloud Bursting from Openstack to Windows Azure and Amazon AWS with Righ... MultiCloud Bursting from Openstack to Windows Azure and Amazon AWS with Righ...
MultiCloud Bursting from Openstack to Windows Azure and Amazon AWS with Righ...bn-cloud
 
DNS hijacking using cloud providers – No verification needed
DNS hijacking using cloud providers – No verification neededDNS hijacking using cloud providers – No verification needed
DNS hijacking using cloud providers – No verification neededFrans Rosén
 

Similaire à Building an IP Reputation Engine: Tracking the Miscreants (20)

Defcon
DefconDefcon
Defcon
 
Leveraging DNS to Surface Attacker Activity
Leveraging DNS to Surface Attacker ActivityLeveraging DNS to Surface Attacker Activity
Leveraging DNS to Surface Attacker Activity
 
Minieri CS6262 Project Poster
Minieri CS6262 Project PosterMinieri CS6262 Project Poster
Minieri CS6262 Project Poster
 
New DNS Traffic Analysis Techniques to Identify Global Internet Threats
New DNS Traffic Analysis Techniques to Identify Global Internet ThreatsNew DNS Traffic Analysis Techniques to Identify Global Internet Threats
New DNS Traffic Analysis Techniques to Identify Global Internet Threats
 
Apache Directory and the OSGi Service Platform - Enrique Rodriguez, PMC Membe...
Apache Directory and the OSGi Service Platform - Enrique Rodriguez, PMC Membe...Apache Directory and the OSGi Service Platform - Enrique Rodriguez, PMC Membe...
Apache Directory and the OSGi Service Platform - Enrique Rodriguez, PMC Membe...
 
Automate or die! Rootedcon 2017
Automate or die! Rootedcon 2017Automate or die! Rootedcon 2017
Automate or die! Rootedcon 2017
 
Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...
Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...
Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...
 
DNSSEC Tutorial, by Champika Wijayatunga [APNIC 38]
DNSSEC Tutorial, by Champika Wijayatunga [APNIC 38]DNSSEC Tutorial, by Champika Wijayatunga [APNIC 38]
DNSSEC Tutorial, by Champika Wijayatunga [APNIC 38]
 
Orchestrating Docker with Terraform and Consul by Mitchell Hashimoto
Orchestrating Docker with Terraform and Consul by Mitchell Hashimoto Orchestrating Docker with Terraform and Consul by Mitchell Hashimoto
Orchestrating Docker with Terraform and Consul by Mitchell Hashimoto
 
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
 
ICANN 51: Name Collision
ICANN 51: Name CollisionICANN 51: Name Collision
ICANN 51: Name Collision
 
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
 
Dns and Dnssec
Dns and DnssecDns and Dnssec
Dns and Dnssec
 
DNS как линия защиты/DNS as a Defense Vector
DNS как линия защиты/DNS as a Defense VectorDNS как линия защиты/DNS as a Defense Vector
DNS как линия защиты/DNS as a Defense Vector
 
HSB - Secure DNS en BGP ontwikkelingen - Benno Overeinder
HSB - Secure DNS en BGP ontwikkelingen - Benno OvereinderHSB - Secure DNS en BGP ontwikkelingen - Benno Overeinder
HSB - Secure DNS en BGP ontwikkelingen - Benno Overeinder
 
DNS for Developers - NDC Oslo 2016
DNS for Developers - NDC Oslo 2016DNS for Developers - NDC Oslo 2016
DNS for Developers - NDC Oslo 2016
 
DEF CON 27 - TRAVIS PALMER - first try dns cache poisoning with ipv4 and ipv6...
DEF CON 27 - TRAVIS PALMER - first try dns cache poisoning with ipv4 and ipv6...DEF CON 27 - TRAVIS PALMER - first try dns cache poisoning with ipv4 and ipv6...
DEF CON 27 - TRAVIS PALMER - first try dns cache poisoning with ipv4 and ipv6...
 
AWS User Group - Perth - April 2021 - DNS
AWS User Group - Perth - April 2021 - DNSAWS User Group - Perth - April 2021 - DNS
AWS User Group - Perth - April 2021 - DNS
 
MultiCloud Bursting from Openstack to Windows Azure and Amazon AWS with Righ...
MultiCloud Bursting from Openstack to Windows Azure and Amazon AWS with Righ... MultiCloud Bursting from Openstack to Windows Azure and Amazon AWS with Righ...
MultiCloud Bursting from Openstack to Windows Azure and Amazon AWS with Righ...
 
DNS hijacking using cloud providers – No verification needed
DNS hijacking using cloud providers – No verification neededDNS hijacking using cloud providers – No verification needed
DNS hijacking using cloud providers – No verification needed
 

Plus de AlienVault

Meltdown and Spectre - How to Detect the Vulnerabilities and Exploits
Meltdown and Spectre - How to Detect the Vulnerabilities and ExploitsMeltdown and Spectre - How to Detect the Vulnerabilities and Exploits
Meltdown and Spectre - How to Detect the Vulnerabilities and ExploitsAlienVault
 
Malware Invaders - Is Your OS at Risk?
Malware Invaders - Is Your OS at Risk?Malware Invaders - Is Your OS at Risk?
Malware Invaders - Is Your OS at Risk?AlienVault
 
How to Solve Your Top IT Security Reporting Challenges with AlienVault
How to Solve Your Top IT Security Reporting Challenges with AlienVaultHow to Solve Your Top IT Security Reporting Challenges with AlienVault
How to Solve Your Top IT Security Reporting Challenges with AlienVaultAlienVault
 
Simplify PCI DSS Compliance with AlienVault USM
Simplify PCI DSS Compliance with AlienVault USMSimplify PCI DSS Compliance with AlienVault USM
Simplify PCI DSS Compliance with AlienVault USMAlienVault
 
SIEM for Beginners: Everything You Wanted to Know About Log Management but We...
SIEM for Beginners: Everything You Wanted to Know About Log Management but We...SIEM for Beginners: Everything You Wanted to Know About Log Management but We...
SIEM for Beginners: Everything You Wanted to Know About Log Management but We...AlienVault
 
Insider Threat Detection Recommendations
Insider Threat Detection RecommendationsInsider Threat Detection Recommendations
Insider Threat Detection RecommendationsAlienVault
 
Alienvault threat alerts in spiceworks
Alienvault threat alerts in spiceworksAlienvault threat alerts in spiceworks
Alienvault threat alerts in spiceworksAlienVault
 
Open Source IDS Tools: A Beginner's Guide
Open Source IDS Tools: A Beginner's GuideOpen Source IDS Tools: A Beginner's Guide
Open Source IDS Tools: A Beginner's GuideAlienVault
 
Malware detection how to spot infections early with alien vault usm
Malware detection how to spot infections early with alien vault usmMalware detection how to spot infections early with alien vault usm
Malware detection how to spot infections early with alien vault usmAlienVault
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controlsAlienVault
 
PCI DSS Implementation: A Five Step Guide
PCI DSS Implementation: A Five Step GuidePCI DSS Implementation: A Five Step Guide
PCI DSS Implementation: A Five Step GuideAlienVault
 
Improve threat detection with hids and alien vault usm
Improve threat detection with hids and alien vault usmImprove threat detection with hids and alien vault usm
Improve threat detection with hids and alien vault usmAlienVault
 
The State of Incident Response - INFOGRAPHIC
The State of Incident Response - INFOGRAPHICThe State of Incident Response - INFOGRAPHIC
The State of Incident Response - INFOGRAPHICAlienVault
 
Incident response live demo slides final
Incident response live demo slides finalIncident response live demo slides final
Incident response live demo slides finalAlienVault
 
Improve Situational Awareness for Federal Government with AlienVault USM
Improve Situational Awareness for Federal Government with AlienVault USMImprove Situational Awareness for Federal Government with AlienVault USM
Improve Situational Awareness for Federal Government with AlienVault USMAlienVault
 
Improve Security Visibility with AlienVault USM Correlation Directives
Improve Security Visibility with AlienVault USM Correlation DirectivesImprove Security Visibility with AlienVault USM Correlation Directives
Improve Security Visibility with AlienVault USM Correlation DirectivesAlienVault
 
How Malware Works
How Malware WorksHow Malware Works
How Malware WorksAlienVault
 
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than EverNew USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than EverAlienVault
 
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than EverAlienVault
 
AWS Security Best Practices for Effective Threat Detection & Response
AWS Security Best Practices for Effective Threat Detection & ResponseAWS Security Best Practices for Effective Threat Detection & Response
AWS Security Best Practices for Effective Threat Detection & ResponseAlienVault
 

Plus de AlienVault (20)

Meltdown and Spectre - How to Detect the Vulnerabilities and Exploits
Meltdown and Spectre - How to Detect the Vulnerabilities and ExploitsMeltdown and Spectre - How to Detect the Vulnerabilities and Exploits
Meltdown and Spectre - How to Detect the Vulnerabilities and Exploits
 
Malware Invaders - Is Your OS at Risk?
Malware Invaders - Is Your OS at Risk?Malware Invaders - Is Your OS at Risk?
Malware Invaders - Is Your OS at Risk?
 
How to Solve Your Top IT Security Reporting Challenges with AlienVault
How to Solve Your Top IT Security Reporting Challenges with AlienVaultHow to Solve Your Top IT Security Reporting Challenges with AlienVault
How to Solve Your Top IT Security Reporting Challenges with AlienVault
 
Simplify PCI DSS Compliance with AlienVault USM
Simplify PCI DSS Compliance with AlienVault USMSimplify PCI DSS Compliance with AlienVault USM
Simplify PCI DSS Compliance with AlienVault USM
 
SIEM for Beginners: Everything You Wanted to Know About Log Management but We...
SIEM for Beginners: Everything You Wanted to Know About Log Management but We...SIEM for Beginners: Everything You Wanted to Know About Log Management but We...
SIEM for Beginners: Everything You Wanted to Know About Log Management but We...
 
Insider Threat Detection Recommendations
Insider Threat Detection RecommendationsInsider Threat Detection Recommendations
Insider Threat Detection Recommendations
 
Alienvault threat alerts in spiceworks
Alienvault threat alerts in spiceworksAlienvault threat alerts in spiceworks
Alienvault threat alerts in spiceworks
 
Open Source IDS Tools: A Beginner's Guide
Open Source IDS Tools: A Beginner's GuideOpen Source IDS Tools: A Beginner's Guide
Open Source IDS Tools: A Beginner's Guide
 
Malware detection how to spot infections early with alien vault usm
Malware detection how to spot infections early with alien vault usmMalware detection how to spot infections early with alien vault usm
Malware detection how to spot infections early with alien vault usm
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
 
PCI DSS Implementation: A Five Step Guide
PCI DSS Implementation: A Five Step GuidePCI DSS Implementation: A Five Step Guide
PCI DSS Implementation: A Five Step Guide
 
Improve threat detection with hids and alien vault usm
Improve threat detection with hids and alien vault usmImprove threat detection with hids and alien vault usm
Improve threat detection with hids and alien vault usm
 
The State of Incident Response - INFOGRAPHIC
The State of Incident Response - INFOGRAPHICThe State of Incident Response - INFOGRAPHIC
The State of Incident Response - INFOGRAPHIC
 
Incident response live demo slides final
Incident response live demo slides finalIncident response live demo slides final
Incident response live demo slides final
 
Improve Situational Awareness for Federal Government with AlienVault USM
Improve Situational Awareness for Federal Government with AlienVault USMImprove Situational Awareness for Federal Government with AlienVault USM
Improve Situational Awareness for Federal Government with AlienVault USM
 
Improve Security Visibility with AlienVault USM Correlation Directives
Improve Security Visibility with AlienVault USM Correlation DirectivesImprove Security Visibility with AlienVault USM Correlation Directives
Improve Security Visibility with AlienVault USM Correlation Directives
 
How Malware Works
How Malware WorksHow Malware Works
How Malware Works
 
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than EverNew USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever
 
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever
 
AWS Security Best Practices for Effective Threat Detection & Response
AWS Security Best Practices for Effective Threat Detection & ResponseAWS Security Best Practices for Effective Threat Detection & Response
AWS Security Best Practices for Effective Threat Detection & Response
 

Dernier

From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .Alan Dix
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):comworks
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr BaganFwdays
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningLars Bell
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Mattias Andersson
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupFlorian Wilhelm
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionDilum Bandara
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 

Dernier (20)

From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine Tuning
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project Setup
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An Introduction
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 

Building an IP Reputation Engine: Tracking the Miscreants

  • 1. Building an IP Reputation engine Tracking the miscreants
  • 2. Index 1. What is IP Reputation 2. Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 5. Current integrations
  • 3. Index 1. What is IP Reputation 1.1. The problem 1.2. What is IP Reputation? 1.3. What is an IP Reputation engine? 1.4. Features of an IP Reputation engine 2. Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 5. Current integrations
  • 4. The problem Security analyst: “How many of my network connections are going to bad sites?”
  • 5. What is IP Reputation? IP Reputation is a summary of the past behavior activity detected on an IP An IP with reputation information add context when a network connection is observed
  • 6. What is an IP Reputation engine? An IP Reputation engine is a system to classify and score large sets of IPs, in low or high reputation
  • 7. Features of an IP Reputation engine Updated information Accurate values associated to every IP Assign activity classification to every IP Range of detection
  • 8. Index 1. What is IP Reputation 2. Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 5. Current integrations
  • 9. Open Source IP Reputation Portal http://labs.alienvault.com/labs/index.php/projects/open-source-ip-reputation-portal/
  • 10. A register in the reputation.data file: <IP>#<RELIABILITY>#<RISK>#<ACTIVITY>#<COUNTRY>#<CITY>#<LAT>,<LON> 1...10 1...10 C&C Open Proxy Malicious Host Phishing Malware Domain Spamming Malware IP Scanning Host 64.44.240.225#4#3#Malicious Host#US#Chicago#41.9287986755,-87.6315002441 194.176.176.82#4#2#Spamming#RO#Bucharest#44.4333000183,26.1000003815 93.183.203.41#3#2#C&C;Malware Domain#UA#Kiev#50.4333000183,30.5167007446 64.141.101.204#1#2#Malware Domain#CA#Calgary#51.0833015442,-114.083297729 https://reputation.alienvault.com/reputation.data
  • 11. Index 1. What is IP Reputation 2. Open Source IP Reputation Portal 3. How is the engine 3.1. Architecture design 3.1.1. Server 3.1.2. Agent 3.1.3. URL system 3.2. Scoring system 4. Feeding the engine
  • 12. Architecture design Server Database Prefilter URL system Agent IPs/domains URLs Agent DATA IP reputation portal
  • 13. Scoring system DNSBL + BULK DOMAINS + DYNAMIC IP DYNAMIC DNS + GOOGLE SAFE BROWSING + FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
  • 14. Scoring system DNSBL + $ host 6.6.6.6.zen.spamhaus.org Host 6.6.6.6.zen.spamhaus.org not BULK DOMAINS + found: 3(NXDOMAIN) DYNAMIC IP $ host 2.0.0.127.zen.spamhaus.org 2.0.0.127.zen.spamhaus.org has DYNAMIC DNS + address 127.0.0.10 2.0.0.127.zen.spamhaus.org has address 127.0.0.2 GOOGLE SAFE BROWSING + 2.0.0.127.zen.spamhaus.org has address 127.0.0.4 FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
  • 15. Scoring system DNSBL + *.co.be BULK DOMAINS + *.co.cc *.co.com.au DYNAMIC IP *.co.tv *.com.ua DYNAMIC DNS + *.cu.cc GOOGLE SAFE BROWSING + *.cw.cm *.cx.cc FILE-SHARING IP - *.cz.cc ALEXA TOP ONE MILLION - *.cz.tf HEURISTIC DOMAIN +
  • 16. Scoring system DNSBL + BULK DOMAINS + $ host 87.216.x.x DYNAMIC IP x.x.216.87.in-addr.arpa domain name pointer x.x.216.87.dynamic.jazztel.es. DYNAMIC DNS + GOOGLE SAFE BROWSING + FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
  • 17. Scoring system DNSBL + BULK DOMAINS + *.ath.cx DYNAMIC IP *.dyndns.org DYNAMIC DNS + *.no-ip.biz *.no-ip.info GOOGLE SAFE BROWSING + *.no-ip.org FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
  • 18. Scoring system DNSBL + BULK DOMAINS + DYNAMIC IP DYNAMIC DNS + GOOGLE SAFE BROWSING + FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
  • 19. Scoring system DNSBL + BULK DOMAINS + DYNAMIC IP DYNAMIC DNS + GOOGLE SAFE BROWSING + FILE-SHARING IP - ALEXA TOP ONE MILLION - HEURISTIC DOMAIN +
  • 20. Scoring system DNSBL + BULK DOMAINS + 1, google.com DYNAMIC IP 2, facebook.com 3, youtube.com 4, yahoo.com DYNAMIC DNS + 5, baidu.com 6, wikipedia.org GOOGLE SAFE BROWSING + 7, live.com 8, blogspot.com 9, amazon.com FILE-SHARING IP - 10, twitter.com ... ALEXA TOP ONE MILLION - 999999, panciapiatta.net 1000000, acsysun.co.jp HEURISTIC DOMAIN +
  • 21. Scoring system DNSBL + BULK DOMAINS + ypyfp.com.tw jlmjalzjk.gs ewdkddr.me DYNAMIC IP xzasuf.com.pt nnis.co.uk DYNAMIC DNS + qzlx.co.za tuxs.com.ua GOOGLE SAFE BROWSING + upwcbab.tw hkwytkey.pe uzabfgqfk.my FILE-SHARING IP - http://labs.alienvault.com/labs/ index.php/2012/detecting-malware- ALEXA TOP ONE MILLION - domains-by-syntax-heuristics/ HEURISTIC DOMAIN +
  • 22. Index 1. What is IP Reputation 2. Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 4.1. External sources 4.2. Our sandnet 4.3. AlienVault OTX 5. Current integrations
  • 23. Getting data from external sources { Malware Trackers Malicious Hosts lists Open Proxy lists Scanning Hosts lists SPAM Trackers and more...
  • 24. Our sandnet Samples Queue Sandbox Sandnet web panel Sandnet { } Database Traffic, rules trigger Traffic, no rules trigger No traffic! IP Reputation Database
  • 25. AlienVault OTX is a system for sharing threat intelligence among OSSIM users and AlienVault customers. http://www.alienvault.com/alienvault-labs/open- threat-exchange/
  • 26.
  • 27.
  • 28. Index 1. What is IP Reputation 2. What is the Open Source IP Reputation Portal 3. How is the engine 4. Feeding the engine 5. Current integrations 5.1. Integration in OSSIM 5.2. Other integrations
  • 29. Integration in OSSIM OSSIM is an Open Source SIEM (Security Information Event Management). A comprehensive compilation of tools that work together to provide a detailed view over each and every aspect of your networks, hosts, physical access devices, server, etc. http://communities.alienvault.com/community A security event manager (SEM) (acronyms SIEM and SIM) is a computerized tool used on enterprise data networks to centralize the storage and interpretation of logs, or events, generated by other software running on the network. http://en.wikipedia.org/wiki/Security_event_manager
  • 30. { fprobe, nfSen (flow collector and analyzer) Snort (IDS) + EmergingThreats ruleset OSSEC (HIDS) Nagios (service and infrastructure monitoring) OpenVAS, Nessus (vulnerability assessment) p0f, PADS, arpwatch (passive network monitoring) nmap (network scanning) OCS Inventory NG (host-based inventory) Wireshark, tcpdump (full packet capture) and more...
  • 31. { data collection with plugins: routers, firewalls, switches... load balancers, intrusion prevention systems honeypots, web proxies, web application firewalls ...
  • 32. OSSIM architecture Find patterns Server Correlation engine Insert events Normalized data Sensors Database Detects new data DATA
  • 33. Logic correlation if detected firewall or proxy event + and is an ACCEPT or HTTP code 200 OK event + and the destination IP has a low reputation = alarm <directive id="29001" name="Suspicious communication on SRC_IP" priority="5"> <rule type="detector" name="HTTP connection to low IP reputation destination" plugin_id="1503" plugin_sid="1" reliability="10" occurrence="1" from="HOME_NET" to="!HOME_NET" port_from="ANY" port_to="80,443" to_reputation="true" protocol="TCP"/> </directive>
  • 35. Other integrations Snort reputation format Iptables format Squid format Unix (hosts.deny) format More to come: shellscripts, configuration guides, nfSen plugin...
  • 36. Future of the IP reputation Live scoring API Predictive IP reputation Extent to domain blocklist
  • 37. Conclusions 1. Free to use IP Reputation database 2. Detailed information about the activity and history of every IP through the web portal 3. Continuously updated and maintained using different resources and improved with AlienVault OTX 4. Fully integrated in OSSIM, ready to be easily integrated with another systems
  • 38. http://labs.alienvault.com Alberto Ortega Guillermo Grande a0rtega Guillermo aortega@alienvault.com ggrande@alienvault.com