| Paper Abstract and Keywords |
| Presentation |
2006-10-17 14:15
[Invited Talk]
nicter: An Incident Analysis System for the Global Internet using Correlation between Network Monitoring and Malware Analysis
Koji Nakao, Katsunari Yoshioka, Masashi Eto, Daisuke Inoue, Kenji Rikitake (NICT) |
| Abstract |
(in Japanese) |
(See Japanese page) |
| (in English) |
As network security incidents are being more complex and serious, activities of network monitoring, incident analysis and response are becoming increasingly important. In this paper, we propose an incident analysis system called nicter. The nicter monitors wide range of networks by distributed sensors for detecting an incident candidate (IC), such as unseen attacking behaviors or a sudden increase of certain type of traffics, which may indicate the occurrence of incidents. The nicter also keeps collecting malware executables in the wild using various malware capturing techniques and analyzing their internal and external behaviors and characteristics. The macroscopic analysis results from network monitoring and microscopic analysis results from malware analysis are correlated so that the detected ICs are bound with their possible root causes, namely propagations of malwares. We describe the macro-micro correlation with an actual analysis case as well as explaining the role of each analysis method. |
| Keyword |
(in Japanese) |
(See Japanese page) |
| (in English) |
network security / incident analysis system / network monitoring / malware analysis / integrated incident handling and response / / / |
| Reference Info. |
IEICE Tech. Rep., vol. 106, no. 292, DC2006-30, pp. 25-30, Oct. 2006. |
| Paper # |
DC2006-30 |
| Date of Issue |
2006-10-10 (DE, DC) |
| ISSN |
Print edition: ISSN 0913-5685 |
| Download PDF |
|
| Conference Information |
| Committee |
DE DC |
| Conference Date |
2006-10-17 - 2006-10-18 |
| Place (in Japanese) |
(See Japanese page) |
| Place (in English) |
|
| Topics (in Japanese) |
(See Japanese page) |
| Topics (in English) |
|
| Paper Information |
| Registration To |
DC |
| Conference Code |
2006-10-DE-DC |
| Language |
English |
| Title (in Japanese) |
(See Japanese page) |
| Sub Title (in Japanese) |
(See Japanese page) |
| Title (in English) |
nicter: An Incident Analysis System for the Global Internet using Correlation between Network Monitoring and Malware Analysis |
| Sub Title (in English) |
|
| Keyword(1) |
network security |
| Keyword(2) |
incident analysis system |
| Keyword(3) |
network monitoring |
| Keyword(4) |
malware analysis |
| Keyword(5) |
integrated incident handling and response |
| Keyword(6) |
|
| Keyword(7) |
|
| Keyword(8) |
|
| 1st Author's Name |
Koji Nakao |
| 1st Author's Affiliation |
National Institute of Information and Communications Technology (NICT) |
| 2nd Author's Name |
Katsunari Yoshioka |
| 2nd Author's Affiliation |
National Institute of Information and Communications Technology (NICT) |
| 3rd Author's Name |
Masashi Eto |
| 3rd Author's Affiliation |
National Institute of Information and Communications Technology (NICT) |
| 4th Author's Name |
Daisuke Inoue |
| 4th Author's Affiliation |
National Institute of Information and Communications Technology (NICT) |
| 5th Author's Name |
Kenji Rikitake |
| 5th Author's Affiliation |
National Institute of Information and Communications Technology (NICT) |
| 6th Author's Name |
|
| 6th Author's Affiliation |
() |
| 7th Author's Name |
|
| 7th Author's Affiliation |
() |
| 8th Author's Name |
|
| 8th Author's Affiliation |
() |
| 9th Author's Name |
|
| 9th Author's Affiliation |
() |
| 10th Author's Name |
|
| 10th Author's Affiliation |
() |
| 11th Author's Name |
|
| 11th Author's Affiliation |
() |
| 12th Author's Name |
|
| 12th Author's Affiliation |
() |
| 13th Author's Name |
|
| 13th Author's Affiliation |
() |
| 14th Author's Name |
|
| 14th Author's Affiliation |
() |
| 15th Author's Name |
|
| 15th Author's Affiliation |
() |
| 16th Author's Name |
|
| 16th Author's Affiliation |
() |
| 17th Author's Name |
|
| 17th Author's Affiliation |
() |
| 18th Author's Name |
|
| 18th Author's Affiliation |
() |
| 19th Author's Name |
|
| 19th Author's Affiliation |
() |
| 20th Author's Name |
|
| 20th Author's Affiliation |
() |
| 21st Author's Name |
|
| 21st Author's Affiliation |
() |
| 22nd Author's Name |
|
| 22nd Author's Affiliation |
() |
| 23rd Author's Name |
|
| 23rd Author's Affiliation |
() |
| 24th Author's Name |
|
| 24th Author's Affiliation |
() |
| 25th Author's Name |
|
| 25th Author's Affiliation |
() |
| 26th Author's Name |
/ / |
| 26th Author's Affiliation |
()
() |
| 27th Author's Name |
/ / |
| 27th Author's Affiliation |
()
() |
| 28th Author's Name |
/ / |
| 28th Author's Affiliation |
()
() |
| 29th Author's Name |
/ / |
| 29th Author's Affiliation |
()
() |
| 30th Author's Name |
/ / |
| 30th Author's Affiliation |
()
() |
| 31st Author's Name |
/ / |
| 31st Author's Affiliation |
()
() |
| 32nd Author's Name |
/ / |
| 32nd Author's Affiliation |
()
() |
| 33rd Author's Name |
/ / |
| 33rd Author's Affiliation |
()
() |
| 34th Author's Name |
/ / |
| 34th Author's Affiliation |
()
() |
| 35th Author's Name |
/ / |
| 35th Author's Affiliation |
()
() |
| 36th Author's Name |
/ / |
| 36th Author's Affiliation |
()
() |
| Speaker |
Author-2 |
| Date Time |
2006-10-17 14:15:00 |
| Presentation Time |
60 minutes |
| Registration for |
DC |
| Paper # |
DE2006-123, DC2006-30 |
| Volume (vol) |
vol.106 |
| Number (no) |
no.290(DE), no.292(DC) |
| Page |
pp.25-30 |
| #Pages |
6 |
| Date of Issue |
2006-10-10 (DE, DC) |