High correlation in failure of information systems due to worms and viruses has been cited
as major impediment to cyber-insurance. However, of the many cyber-risk classes that …

This paper presents an experimental study and the lessons learned from the observation of
the attackers when logged on a compromised machine. The results are based on a six …

Spitzner proposed to classify honeypots into low, medium and high interaction ones. Several
instances of low interaction exist, such as honeyd, as well as high interaction, such as GenII …

Abstract The CADHo project (Collection and Analysis of Data from Honeypots) is an ongoing
research action funded by the French ACI “Securiteé & Informatique”[1]. It aims at building …

Wespi. Without your help this thesis would not have gotten to this stage. Clearly, I am solely
responsible for any mistakes that had remained in the report. Last but not least, I am deeply …

Passive network monitors, known as telescopes or darknets, have been invaluable in
detecting and characterizing malware outbreaks. However, as the use of such monitors …

There is an increasing awareness of the growing influence of organized entities involved in
today's Internet attacks. However, there is no easy way to discriminate between the …

This dissertation studies how to defend against denial of service (DoS) attacks in computer
networks. As it is not possible to prevent these attacks, one must concentrate on mitigating …

Worms cause correlated failure of many systems in a short span of time. Therefore,
automated defensive approaches have been proposed to counter growth of worms …

WOMBAT: towards a Worldwide Observatory of Malicious Behaviors and Attack Threats Page
1 TF-CSIRT 2006 WOMBAT: towards a Worldwide Observatory of Malicious Behaviors and …