Honeycomb

By Christian Peter Kreibich, Jon Crowcroft. Computer communication review, 2004

476 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/a058558ddef924d8146c09cbaa7b68bc921f922c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Aloysius Ka-Lau Mok
2. Simon Pak Ho Chung
3. Christopher Krügel
4. Giovanni Vigna
5. Engin Kirda
6. Darren H. Mutz
7. Ansam Khraisat
8. William K. Robertson

In Computer Networks and Communications

1. Aloysius Ka-Lau Mok
2. Simon Pak Ho Chung
3. Christopher Krügel
4. Miguel Oom Temudo de Castro
5. Giovanni Vigna
6. Darren H. Mutz
7. Engin Kirda
8. Ansam Khraisat

In Hardware and Architecture

1. Aloysius Ka-Lau Mok
2. Simon Pak Ho Chung
3. Manuel Costa
4. Paul Barham
5. Herbert Bos
6. Georgios Portokalidis
7. Antony Ian Taylor Rowstron
8. Giovanni Vigna

Citations in the corpus

• Allergy Attack Against Automatic Signature Generation (2006, methodology): “For example, Autograph, Honeycomb, EarlyBird, and the CFG-based system in [6] all employ detection mechanisms with non-zero false positive.”
• Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation (2006, background): “Existing automated response systems tend to incur a fairly large ratio of false positives in attack detection and use of signatures [43, 37, 23, 15, 27].”
• Advanced Allergy Attacks: Does a Corpus Really Help? (2007, background): “In most published ASGs (like [6,17,5]), suspicious traffic is identified by some network-based monitoring mechanisms.”
• Survey of intrusion detection systems: techniques, datasets and challenges (2019, background): “SIDS usually gives an excellent detection accuracy for previously known intrusions (Kreibich & Crowcroft, 2004).”
• Polymorphic Worm Detection Using Structural Information of Executables (2005, background): “The first system to automatically extract signatures from network traffic was Honeycomb [8], which looks for common substrings in traffic sent to a honeypot.”
• Vigilante: end-to-end containment of internet worms (2005, background): “Worm signatures have traditionally been generated by humans but there are several recent proposals to generate signatures automatically [24, 22, 38].”
• Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience (2006, background): “One is that some byte patterns may be unavoidable for the successful execution of the worm.”