Graduate School and Research Center in Digital Sciences

SGNET: a distributed infrastructure to handle zero-day exploits

Leita, Corrado; Dacier, Marc; Wicherski, Georg

Research report RR-07-187 - Extended version of this paper at EDCC 2008

This work builds upon the Leurre.com infrastructure and the Scriptgen technology. Leurr´e.com is a worldwide distributed setup of low interaction honeypots whereas Scriptgen is a new class of honeypot: a medium interaction one. In this paper, we see how Scriptgen can be enriched thanks to the Argos and Nepenthes open source software in order to build a distributed system able to collect rich information about ongoing attacks and to collect malware, even for zero-day attacks, without facing the same liability and complexity issues encountered by classical high interaction honeypots. The design is precisely exposed as well as its implementation. Experimental results are offered that highlight the validity of the proposed solution.

Document Bibtex

Title:SGNET: a distributed infrastructure to handle zero-day exploits
Type:Report
Language:English
Date:
Department:Digital Security
Eurecom ref:2164
Copyright: © EURECOM. Personal use of this material is permitted. The definitive version of this paper was published in Research report RR-07-187 - Extended version of this paper at EDCC 2008 and is available at :
Bibtex: @techreport{EURECOM+2164, year = {2007}, title = {{SGNET}: a distributed infrastructure to handle zero-day exploits}, author = {{L}eita, {C}orrado and {D}acier, {M}arc and {W}icherski, {G}eorg}, number = {EURECOM+2164}, month = {02}, institution = {Eurecom}, url = {http://www.eurecom.fr/publication/2164},, }
See also: