Virtual Honeypots- From Botnet Tracking to Intrusion Detection - Graphically Rich Book by Detection, From Botnet Tracking to Intrusion -- Read -- Imperial Library of Trantor

Index

Virtual Honeypots: From Botnet Tracking to Intrusion Detection - Graphically Rich Book Table of Contents Copyright Praise for Virtual Honeypots Preface Acknowledgments About the Authors Chapter 1. Honeypot and Networking Background

Section 1.1. Brief TCP/IP Introduction Section 1.2. Honeypot Background Section 1.3. Tools of the Trade

Chapter 2. High-Interaction Honeypots

Section 2.1. Advantages and Disadvantages Section 2.2. VMware Section 2.3. User-Mode Linux Section 2.4. Argos Section 2.5. Safeguarding Your Honeypots Section 2.6. Summary

Chapter 3. Low-Interaction Honeypots

Section 3.1. Advantages and Disadvantages Section 3.2. Deception Toolkit Section 3.3. LaBrea Section 3.4. Tiny Honeypot Section 3.5. GHH - Google Hack Honeypot Section 3.6. PHP.HoP - A Web-Based Deception Framework Section 3.7. Securing Your Low-Interaction Honeypots Section 3.8. Summary

Chapter 4. Honeyd - The Basics

Section 4.1. Overview Section 4.2. Design Overview Section 4.3. Receiving Network Data Section 4.4. Runtime Flags Section 4.5. Configuration Section 4.6. Experiments with Honeyd Section 4.7. Services Section 4.8. Logging Section 4.9. Summary

Chapter 5. Honeyd - Advanced Topics

Section 5.1. Advanced Configuration Section 5.2. Emulating Services Section 5.3. Subsystems Section 5.4. Internal Python Services Section 5.5. Dynamic Templates Section 5.6. Routing Topology Section 5.7. Honeydstats Section 5.8. Honeydctl Section 5.9. Honeycomb Section 5.10. Performance Section 5.11. Summary

Chapter 6. Collecting Malware with Honeypots

Section 6.1. A Primer on Malicious Software Section 6.2. Nepenthes - A Honeypot Solution to Collect Malware Section 6.3. Honeytrap Section 6.4. Other Honeypot Solutions for Learning About Malware Section 6.5. Summary

Chapter 7. Hybrid Systems

Section 7.1. Collapsar Section 7.2. Potemkin Section 7.3. RolePlayer Section 7.4. Research Summary Section 7.5. Building Your Own Hybrid Honeypot System Section 7.6. Summary

Chapter 8. Client Honeypots

Section 8.1. Learning More About Client-Side Threats Section 8.2. Low-Interaction Client Honeypots Section 8.3. High-Interaction Client Honeypots Section 8.4. Other Approaches Section 8.5. Summary

Chapter 9. Detecting Honeypots

Section 9.1. Detecting Low-Interaction Honeypots Section 9.2. Detecting High-Interaction Honeypots Section 9.3. Detecting Rootkits Section 9.4. Summary

Chapter 10. Case Studies

Section 10.1. Blast-o-Mat: Using Nepenthes to Detect Infected Clients Section 10.2. Search Worms Section 10.3. Red Hat 8.0 Compromise Section 10.4. Windows 2000 Compromise Section 10.5. SUSE 9.1 Compromise Section 10.6. Summary

Chapter 11. Tracking Botnets

Section 11.1. Bot and Botnet 101 Section 11.2. Tracking Botnets Section 11.3. Case Studies Section 11.4. Defending Against Bots Section 11.5. Summary

Chapter 12. Analyzing Malware with CWSandbox

Section 12.1. CWSandbox Overview Section 12.2. Behavior-Based Malware Analysis Section 12.3. CWSandbox - System Description Section 12.4. Results Section 12.5. Summary

Bibliography Index

A B C D E F G H I K L M N O P Q R S T U V W X Y Z