| Abstract: |
Four years after the Code-Red worm attack, self-replicating malware represent one of the major threats to the security of the Internet. Traffic monitors, also known as network telescopes or darknets, that record packets arriving to unused portions of the IP address space have been proposed as tools for detecting novel attacks as well as forensics tools gleaning information about past attacks. In this talk we are going to give two examples that showcase the power of network telescopes, introduce models that provide limits on their power, and present experimental results that verify the importance of telescopes in early detection and forensic analysis. The last part of the talk will be focused on future directions for malware mitigation as well as potential new threats. |
