Experiences with the NoAH Honeynet Testbed to Detect new Internet Worms

摘要: Recently, major advances have been made in the area of honeypot technologies. These include development very accurate and reliable detection methods for unknown attacks targeted at memory corruption vulnerabilities design efficient network architectures. architectures allow to monitor a large IP addresses applying advanced zero-day exploits new Internet worms. Such an architecture method was developed by NoAH research project funded Sixth EU’s Framework Programme Research Technological Development. A pilot testbed set up demonstrate its effectiveness detect well-known as well on Internet. While technical components are well-understood, interpretation analysis resulting information is best our knowledge still not fully explored projects. For testbed, critical test arose with appearance W32.Conficker worm November 2008. In this paper we present experimental results focusing which widely spread ongoing threat detail, introduce process starting first suspicion towards capture malware.