60 likes | 154 Views
Questions on “Data Reduction for the Scalable Automated Analysis of Distributed Darknet Traffic”. Yao Zhao. Hybrid Architecture. IMS + HMS IMS Proxy back to HMS Detectable by delay. Filtering with First Payload. Only use hash of the payload
E N D
Questions on “Data Reduction for the Scalable Automated Analysis of Distributed Darknet Traffic” Yao Zhao
Hybrid Architecture • IMS + HMS • IMS Proxy back to HMS • Detectable by delay
Filtering with First Payload • Only use hash of the payload • A little bit change in the first payload will escape • Polymorphic worms
Collaboration Works? • The IDS collaboration paper tells that collaboration helps much • This paper tries to say collaboration of darknet doesn’t make much sense.
Duration of Event • Figure 8 • Obtained from one honeypot host • Heavy tail? • Long durations • A single /17 darknet block need to handle from 40,000 to 200,000 simultaneous connections • But session <> infection session