Detecting Botnets with NetFlow

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F11%3A00050703" target="_blank" >RIV/00216224:14610/11:00050703 - isvavai.cz</a>

Result on the web

—

DOI - Digital Object Identifier

—

Result language

angličtina

Original language name

Detecting Botnets with NetFlow

Original language description

Network security awareness based on flow monitoring (NetFlow) is used with success at Masaryk University. We have discovered a new botnet called Chuck Norris at Masaryk University in December 2009. This botnet attacks vulnerable devices as ADSL modems and routers. In this talk, we will present and describe a set of detection methods for revealing Chuck Norris botnet in observed network using flow data. Also we will show the implementation of these methods as a plugin for NetFlow collector NfSen.

Czech name

—

Czech description

—

Type

A - Audiovisual production

CEP classification

IN - Informatics

OECD FORD branch

—

Project

<a href="/en/project/OVMASUN200801" target="_blank" >OVMASUN200801: Security of Czech army information and communication systems - On-line monitoring, Visualization and Packet Filtration. Computer Incident Response Capability Development in the Cyber Defence Environment.</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach

Publication year

2011

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

ISBN

—

Place of publication

—

Publisher/client name

—

Version

—

Carrier ID

—