M. Corrado LEITA will publicly defend his UNS Doctoral Thesis
on Thursday, December 4th 2008 at 2:00 pm, in the Amphitheater MARCONI at EURECOM.
Topic of the Thesis:
"SGNET: automated protocol learning for the observation of malicious threats"
Jury members :
- Marc DACIER (Symantec)
- Vern PAXSON (ICSI)
- Hervé DEBAR (France Télécom R&D/Orange Labs)
- Engin KIRDA (Eurecom)
- Christopher KRUEGEL (UCSB)
- Mohamed KAANICHE (LAAS CNRS)
- Sotiris IOANNIDIS (FORTH)
One of the main prerequisites for the development of reliable defenses to protect a network resource consists in the collection of quantitative data on Internet threats. This attempt to "know your enemy" leads to an increasing interest in the collection and exploitation of datasets providing intelligence on network attacks. The creation of these datasets is a very challenging task. The challenge derives from the need to cope with the spatial and quantitative diversity of malicious activities. The observations need to be performed on a broad perspective, since the activities are not uniformly distributed over the IP space. At the same time, the data collectors need to be sophisticated enough to extract a sufficient amount of information on each activity and perform meaningful inferences. How to combine the simultaneous need to deploy a vast number of data collectors with the need of sophistication required to make meaningful observations? This work addresses this challenge by proposing a protocol learning technique based on bioinformatics algorithms. The proposed technique allows to automatically generate low-cost protocol responders starting from a set of samples of network interaction. Its characteristics are exploited in a distributed honeypot deployment that collected information on Internet attacks for a period of 8 months in 23 different networks distributed all over the world (Europe, Australia, United States). This information is organized in a central dataset enriched with contextual information from a number of sources and analysis tools. Simple data mining techniques proposed in this work allow the generation of a valuable overview on the propagation techniques employed by nowadays malware.
