Nicter: An incident analysis system toward binding network monitoring with malware analysis

Proceedings - WOMBAT Workshop on Information Security Threats Data Collection and Sharing, WISTDCS 2008

Volumn , Issue , 2008, Pages 58-66

  Inoue, Daisuke ^a   Eto, Masashi ^a   Yoshioka, Katsunari ^b   Baba, Shunsuke ^c   Suzuki, Kazuya ^c   Nakazato, Junji ^a   Ohtaka, Kazuhiro ^a   Nakao, Koji ^a  

^a NATIONAL INSTITUTE OF INFORMATION AND COMMUNICATIONS TECHNOLOGY   (Japan)

^b YOKOHAMA NATIONAL UNIVERSITY   (Japan)

^c YOKOGAWA ELECTRIC CORPORATION   (Japan)

Author keywords

[No Author keywords available]

Indexed keywords

DARKNET; EMERGENCY RESPONSES; EXECUTABLES; INCIDENT ANALYSES; IP ADDRESSES; MALICIOUS BEHAVIORS; MALWARE; MALWARE ANALYSIS; MALWARES; MICROSCOPIC ANALYSIS; NETWORK MONITORING; NETWORK THREATS; ROOT CAUSES;

COMPUTER CRIME; DATA ACQUISITION; METALLOGRAPHY; REAL TIME SYSTEMS; SECURITY OF DATA; SECURITY SYSTEMS; SIGNAL FILTERING AND PREDICTION; TECHNICAL PRESENTATIONS;

COMPUTER VIRUSES;

EID: 55149085740     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/WISTDCS.2008.14     Document Type: Conference Paper

References (14)

1. M. Bailey, E. Cooke, F. Jahanian, J. Nazario, and D. Watson, "The Internet Motion Sensor: A Distributed Blackhole Monitoring System," The 12th Annual Network and Distributed System Security Symposium (NDSS05), 2005.
2. D. Moore, "Network Telescopes: Tracking Denial-of-Service Attacks and Internet Worms around the Globe," 17th Large Installation Systems Administration Conference (LISA'03), 2003.
3. SANS Internet Storm Center, http://isc.sans.org/.
4. F. Pouget, M. Dacier, and V.H. Pham, "Leurre.com: On the Advantages of Deploying a Large Scale Distributed Honeypot Platform," E-Crime and Computer Conference (ECCE'05), 2005.
5. REN-ISAC: Research and Education Networking Information Sharing and Analysis Center, http://www.ren-isac.net/.
6. Korea Internet Security Center (KISC), http://www.krcert.net/english/ main.htm.
7. JPCERT/CC Internet Scan Data Acquisition System (ISDAS), http://www.jpcert.or.jp/isdas/.
8. @police, http://www.cyberpolice.go.jp/detect/observation.html.
9. WCLSCAN, http://www.wclscan.org/.
10. IT Security Center, Information-Technology Promotion Agency, Japan, http://www.ipa.go.jp/security/.
11. K. Nakao, K. Yoshioka, D. Inoue, M. Eto, and K. Rikitake, "nicter: An Incident Analysis System using Correlation between Network Monitoring and Malware Analysis," The 1st Joint Workshop on Information Security (JWIS06), pp. 363 - 377, 2006.
12. K. Nakao, K. Yoshioka, D. Inoue, and M. Eto, "A Novel Concept of Network Incident Analysis based on Multi-layer Observations of Malware Activities," The 2nd Joint Workshop on Information Security (JWIS07), pp. 267 - 279, 2007.
13. Anubis, http://analysis.seclab.tuwien.ac.at/.
14. U. Bayer, C. Kruegel, and E. Kirda, "TTAnalyze: A Tool for Analyzing Malware," 15th Annual Conference of the European Institute for Computer Antivirus Research (EICAR), 2006.