Главная
Study mode:
on
1
Introduction
2
Welcome
3
Agenda
4
Current Climate
5
Investigation Process
6
What is Fast Flux
7
Fast Flux Proxy Network
8
Zeus
9
CNC domains
10
Methods
11
Workflow
12
Semantic Library
13
Data Extraction
14
Citadel Examples
15
Botnet Examples
16
What is Pony
17
Passwords
18
Applications
19
Stats
20
Clients
21
IP Style
22
OVH Canada
23
OVH Ukraine
24
OVH Russia
25
Nuclear Exploited Domains
26
Prediction for Fight Protection
27
How we did it
28
Interest
29
Fingerprinting
30
Same server setup
31
Growing trend
32
OVH
33
Rope
34
Electric Kitten
35
Police
36
English dictionaries
37
ASN graph
38
Understanding the internet
39
The IT Crowd
40
The Internet
41
Why do we do this
42
OpenCL view
43
Cluster view
44
Network geek
45
Network connectivity
46
Investigation
47
Conclusions
48
Visual approach
49
Detect
50
Summary
51
BGP Outages
52
ISP Outages
53
Autonomous Systems
54
In Conclusion
Description:
Explore innovative strategies for detecting and mitigating malware at the DNS and IP level in this Black Hat conference talk. Dive into advanced techniques for tracking botnets, including fast flux and DGA-based methods, using graph clustering and DNS traffic analysis. Learn about unconventional approaches to IP reputation that combine AS graph topology analysis with granular IP range investigations. Discover how to preemptively detect and block malicious IP infrastructures, closing the detection gap against evolving threats. Experience the power of 3D visualization in malware analysis, with demonstrations of GPU-accelerated force-directed algorithms and OpenGL ES rendering. Gain insights into real-world "war stories" of hunting down malware domains and rogue IP spaces, and explore practical tools for gathering predictive threat intelligence.

Catching Malware En Masse - DNS and IP Style

Black Hat
Add to list
0:00 / 0:00