View source for Data transforming your sewage into signatures - lessons learnt from building a hybrid honeypot named Amber

From BruCON 2017

← Data transforming your sewage into signatures - lessons learnt from building a hybrid honeypot named Amber

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

You can view and copy the source of this page.

What happens when you collect a bunch of good data, under good pretences only to realise that the findings that you were expecting are completely wrong? Before you quit infosec and retreat to a farm, allow me to tell you about how I data transformed my data sewage into useful signatures. This talk will lay some ground work as to how honeypots relate to traditional security controls and how they differ, especially with regards to what they 'cost' to run. Then we will look at how a very cheap honeypot can be built, and how value can be derived from its simplistic output. Finally, I will look at how you can find further value in large data sets (the data set here was collected by the honeypot but the concepts can be applied to anything else) by looking past the obvious and factorising, or transforming the data. Did I mention that there will be drinking involved?

Return to Data transforming your sewage into signatures - lessons learnt from building a hybrid honeypot named Amber.

Retrieved from "https://2017.brucon.org/index.php/Data_transforming_your_sewage_into_signatures_-_lessons_learnt_from_building_a_hybrid_honeypot_named_Amber"

navigation

SEARCH

TOOLBOX

LANGUAGES

View source for Data transforming your sewage into signatures - lessons learnt from building a hybrid honeypot named Amber

From BruCON 2017