39 matches found
strafer
Strafer Elasticsearch 感染正呈指数级增长。攻击者利用开放和暴露的 Elasticsearch 接口在云和非云部署中触发感染。在此次演讲中，我们将发布一款名为 "STRAFER" 的工具，用于检测 Elasticsearch 实例中的潜在感染。该工具允许安全研究人员、渗透测试人员和威胁情报专家检测运行恶意代码的已受损和已感染 Elasticsearch 实例。该工具还使您能够针对以云数据库为目标的恶意软件进行高效研究。在此版本的工具中，支持以下模块： Elasticsearch 实例信息收集与侦察 Elasticsearch 实例在互联网上的暴露情况 检测...
LSTM-MI
DGAボットネット検出におけるマルチクラス不均衡を扱うためのLSTMベースのフレームワーク...
psad
psad - iptables 로그를 이용한 침입 탐지 소개 Port Scan Attack Detector psad는 가벼운 시스템 데몬으로, Linux iptables/ip6tables/firewalld 방화벽 코드와 함께 작동하여 포트 스캔 및 스위프, 백도어, 봇넷 명령 및 제어 통신 등 의심스러운 트래픽을 탐지하도록 설계되었습니다. 이 도구는 매우 구성 가능한 위험 임계값 세트합리적인 기본값 제공, 소스, 대상, 스캔된 포트 범위, 시작 및 종료 시간, TCP 플래그 및 해당 nmap 옵션, 역방향 DNS 정보, 이메일 ...
Botnet Detection on CTU-13 Using Lightweight Machine Learning Models
Botnets are among the most persistent cyber threats, enabling large-scale attacks such as spam, credential theft, and distributed denial-of-service DDoS. While deep learning approaches have recently been applied to botnet detection, they are computationally intensive and often lack...
ML Defender (ARGus NDR): An Open-Source Embedded ML NIDS for Botnet and Anomalous Traffic Detection in Resource-Constrained Organizations
Ransomware and DDoS attacks disproportionately impact hospitals, schools, and small organizations that cannot afford enterprise security solutions. We present ML Defender aRGus NDR, an open-source network intrusion detection system built in C++20, deployable on commodity hardware at approximately...
How the Graph Construction Technique Shapes Performance in IoT Botnet Detection
The increasing incidence of IoT-based botnet attacks has driven interest in advanced learning models for detection. Recent efforts have focused on leveraging attention mechanisms to model long-range feature dependencies and Graph Neural Networks GNNs to capture relationships between data instance...
Toward Real-World IoT Security: Concept Drift-Resilient IoT Botnet Detection Via Latent Space Representation Learning and Alignment
Although AI-based models have achieved high accuracy in IoT threat detection, their deployment in enterprise environments is constrained by reliance on stationary datasets that fail to reflect the dynamic nature of real-world IoT NetFlow traffic, which is frequently affected by concept drift...
A Lightweight Federated Learning Approach for Privacy-Preserving Botnet Detection in IoT
The rapid growth of the Internet of Things IoT has expanded opportunities for innovation but also increased exposure to botnet-driven cyberattacks. Conventional detection methods often struggle with scalability, privacy, and adaptability in resource-constrained IoT environments. To address these...
Leveraging Machine Learning for Botnet Attack Detection in Edge-Computing Assisted IoT Networks
The increase of IoT devices, driven by advancements in hardware technologies, has led to widespread deployment in large-scale networks that process massive amounts of data daily. However, the reliance on Edge Computing to manage these devices has introduced significant security vulnerabilities, a...
New Research: Enhancing Botnet Detection with AI using LLMs and Similarity Search
As botnets continue to evolve, so do the techniques required to detect them. While Transport Layer Security TLS encryption is widely adopted for secure communications, botnets leverage TLS to obscure command-and-control C2 traffic. These malicious actors often have identifiable characteristics...
Detecting Account Takeover Botnets
A botnet is a network of compromised computers - known as bots - usually controlled by a command and control computer, that work together in coordination for a malicious purpose. In this blog post, we’ll discuss how to detect botnets used for account takeover ATO, an attack used to obtain the val...
The Challenges of DIY Botnet Detection – and How to Overcome Them
Botnets have been around for over two decades, and with the rise of the Internet of Things IoT they have spread further to devices no one imagined they would - printers, webcams, and even toasters and fridges. Some botnets enlist infected devices to mine cryptocurrency or steal passwords from oth...
Drupal, Phishing and A New Cryptomining Botnet
It’s a well-known fact that security solutions must quickly adapt to new attack methods. There are several ways to achieve this goal, regularly applying security patches and updates, relying on threat intelligence and more. At Imperva, we use pattern anomaly detection as one of the tools to...
Fast Flux Botnet: Research Results
Just like that, another Akamai Edge has come and gone. If you were able to join us this year, I hope you had a chance to stop by my presentation on Threat Intelligence Insights: An In-Depth Analysis of a Fast Flux Botnet. In short, Fast Flux is a DNS technique used by botnets to hide various type...
Pushdo Botnet Detection
Binary data 6579.prm...
Coming Up With Better Ways to Count — and Counter — Botnets
As botnets continue as a major purveyor of malicious activity, finding new and improved ways to measure their influence will be key to preventing future attacks. But gaining an accurate read on active populations continues to prove difficult. In recent years more research has been devoted to...
Generic IRC Client Detection / Generic Botnet Detection
Binary data 4440.prm...
Generic Botnet Server Detection (HTTP Client)
Binary data 4401.prm...