The nepenthes platform: An efficient approach to collect malware

DMCA

The nepenthes platform: An efficient approach to collect malware (2006)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Paul Baecher , Markus Koetter , Maximillian Dornseif , Felix Freiling

Venue:	In Proceedings of the 9 th International Symposium on Recent Advances in Intrusion Detection (RAID
Citations:	89 - 5 self

BibTeX

@INPROCEEDINGS{Baecher06thenepenthes,
    author = {Paul Baecher and Markus Koetter and Maximillian Dornseif and Felix Freiling},
    title = {The nepenthes platform: An efficient approach to collect malware},
    booktitle = {In Proceedings of the 9 th International Symposium on Recent Advances in Intrusion Detection (RAID},
    year = {2006},
    pages = {165--184},
    publisher = {Springer}
}

OpenURL

Abstract

Abstract. Up to now, there is little empirically backed quantitative and qualitative knowledge about self-replicating malware publicly available. This hampers research in these topics because many counter-strategies against malware, e.g., network- and host-based intrusion detection systems, need hard empirical data to take full effect. We present the nepenthes platform, a framework for large-scale collection of information on self-replicating malware in the wild. The basic principle of nepenthes is to emulate only the vulnerable parts of a service. This leads to an efficient and effective solution that offers many advantages compared to other honeypot-based solutions. Furthermore, nepenthes offers a flexible deployment solution, leading to even better scalability. Using the nepenthes platform we and several other organizations were able to greatly broaden the empirical basis of data available about self-replicating malware and provide thousands of samples of previously unknown malware to vendors of host-based IDS/anti-virus systems. This greatly improves the detection rate of this kind of threat. Keywords: Honeypots, Intrusion Detection Systems, Malware. 1

Keyphrases

nepenthes platform self-replicating malware efficient approach hamper research flexible deployment solution vulnerable part honeypot-based solution unknown malware basic principle host-based intrusion detection system several organization large-scale collection intrusion detection system full effect effective solution qualitative knowledge many advantage many counter-strategies empirical basis hard empirical data detection rate host-based id anti-virus system

DMCA