Zero Day

Researchers borrow from Google PageRank for network defense service

Posted in:

Arbitrary Code Execution
Botnets
Browsers
Complex Attacks
Data theft
Denial of Service (DoS)
Exploit code
Locally Running Web Servers
Microsoft
Open source
Pen testing
Research
Responsible disclosure

Researchers borrow from Google PageRank for network defense service

Using a link analysis algorithm similar to Google PageRank, researchers at the SANS Institute and SRI International have created a new Internet network defense service that completely revamps the way network blacklists are formulated and distributed. The service, called Highly Predictive Blacklisting (.pdf), will be unveiled next week at the Usenix 17th Usenix Security Symposium. An experimental version is currently available for free to all DShield contributors. The skinny:

Highly Predictive Blacklists (HPBs) represent a radically different approach to blacklist formulation. HPBs are derived uniquely per DShield contributor, and rank each attacker in the blacklist based on an estimation of the probability that the attacker will visit the contributor’s network in the future. The HPB algorithm exploits a correlation relationship observed when compiling firewall logs from thousands of Internet contributors.

The idea is to exploit the relationships between networks that have been attacked by similar Internet sources as a means for predicting which attack sources are likely to attack which networks in the future. Much like Google PageRank, which is used to increase the relevance of search results, researchers say the new HPB service will employ a link analysis algorithm to cross-compare firewall logs of DShield contributors with one another in search of overlaps among the attackers they report. The attacker addresses included within an HPB are selected by favoring the inclusion of those attackers who have been encountered by other contributors who share degrees of overlap with the HPB owner. DShield is the data collection engine behind the SANS Internet Storm Center (ISC). * Image source: Wikimedia Commons (Creative Commons 2.5)

posted by Ryan Naraine
July 23, 2008 @ 11:21 am

Previous Post: McAfee debunks recent vulnerabilities in AV software research, n.runs restates its position
Next Post: iPhone vulnerable to phishing, spamming flaws

Last 10 posts:

Opera patches 'extremely severe' security hole (11-23)
Exploit published for critical IE 7 zero-day flaw (11-23)
Inside the Google Chrome OS security model (11-19)
Microsoft finds security hole in Google Chrome Frame (11-19)
Mozilla locks out rogue Firefox add-ons (11-18)
Thousands of web sites compromised, redirect to scareware (11-17)
Microsoft confirms 'detailed' Windows 7 exploit (11-16)
Man-in-the-middle attacks demoed on 4 smartphones (11-13)
Microsoft bracing for malware attacks from embedded fonts (11-12)
Apple Safari exposes Windows to drive-by download attacks (11-11)