TU Darmstadt / ULB / TUbiblio

A Novel Network Platform for Secure and Efficient Malware Collection based on Reconfigurable Hardware Logic

Mühlbach, Sascha and Koch, Andreas (2011):
A Novel Network Platform for Secure and Efficient Malware Collection based on Reconfigurable Hardware Logic.
In: World Congress on Internet Security (WorldCIS 2011), [Conference or Workshop Item]

Abstract

With the growing diversity of malware, researchers must be able to quickly collect many representative samples for study. This can be done, e.g., by using honeypots. As an alternative to software-based honeypots, we propose a singlechip honeypot appliance that is entirely hardware-based and thus significantly more resilient against compromising attacks. Additionally, it can easily keep up with network speeds of 10+ Gb/s and emulate thousands of vulnerable hosts. As base technology, we employ reconfigurable hardware devices whose functionality is not fixed by the manufacturing process. We present improvements to the platform, aiming to simplify management and updates. To this end, we introduce the domain-specific language VEDL, which can be used to describe the honeypot behavior in a highlevel manner by security experts not proficient in hardware design.

Item Type: Conference or Workshop Item
Erschienen: 2011
Creators: Mühlbach, Sascha and Koch, Andreas
Title: A Novel Network Platform for Secure and Efficient Malware Collection based on Reconfigurable Hardware Logic
Language: German
Abstract:

With the growing diversity of malware, researchers must be able to quickly collect many representative samples for study. This can be done, e.g., by using honeypots. As an alternative to software-based honeypots, we propose a singlechip honeypot appliance that is entirely hardware-based and thus significantly more resilient against compromising attacks. Additionally, it can easily keep up with network speeds of 10+ Gb/s and emulate thousands of vulnerable hosts. As base technology, we employ reconfigurable hardware devices whose functionality is not fixed by the manufacturing process. We present improvements to the platform, aiming to simplify management and updates. To this end, we introduce the domain-specific language VEDL, which can be used to describe the honeypot behavior in a highlevel manner by security experts not proficient in hardware design.

Title of Book: World Congress on Internet Security (WorldCIS 2011)
Uncontrolled Keywords: Secure Things
Divisions: LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
LOEWE > LOEWE-Zentren
LOEWE
Date Deposited: 30 Dec 2016 20:23
Identification Number: TUD-CS-2010-02380
Export:
Suche nach Titel in: TUfind oder in Google

Optionen (nur für Redakteure)

View Item View Item