The Nepenthes Platform: An Efficient Approach to Collect Malware

By Paul Baecher, Markus Koetter, Thorsten Holz, M. Dornseif, Felix C. Freiling. International Symposium on Recent Advances in Intrusion Detection, 2006

370 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/b4e72df4e58bce28803e5754c5557ab959a4ad7e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Scalable, Behavior-Based Malware Clustering (2009, background): “Moreover, we have set up nepenthes [11] - a honeypot system that emulates known vulnerabilities of popular services.”
Taxonomy and Survey of Collaborative Intrusion Detection (2015, methodology): “The similarity relation between two alerts is created by an system and is based on the classiﬁcation the alert, time, source, and target.”
Effective and Efficient Malware Detection at the End Host (2009, background): “Also, a number of server-side [4, 43] and client-side honeypots [51] were introduced that allow analysts and researchers to gather malware samples in the wild.”
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, methodology): “To collect and analyze bots, researchers widely utilize honeypot techniques [4, 16, 32].”
Automated Classification and Analysis of Internet Malware (2007, neutral): “[1], the AML consists of binaries collected by a variety of techniques including Web page crawling [28], spam traps [26], and honeypot-based vulnerability emulation [2].”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “Other studies have investigated the internals of bot instances to examine the structural similarities, defense mechanisms, and command and control capabilities of the major bot families [7] and developed techniques to automatically harvest malware samples directly from the Internet [6].”
Automatic analysis of malware behavior using machine learning (2011, neutral): “Hence, a substantial amount of research has focused on development of tools for collection and monitoring of malware (e.g., [2,6,7,31,34,47,69]).”
Learning and Classification of Malware Behavior (2008, background): “Hence, a substantial amount of recent work has focused on development of tools for collecting, monitoring and run-time analysis of malware [3, 5, 6, 15, 23, 24, 26, 28, 37, 39].”
Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm (2008, methodology): “Furthermore, we present two different ways to disrupt the communication channel between controller and compromised machines in order to mitigate the botnet and evaluate the effectiveness of these mechanisms.”
Exploring Multiple Execution Paths for Malware Analysis (2007, methodology): “Also, some tools are already deployed on the Internet and act as live analysis back-ends for honeypot installations such as Nepenthes [1].”
CloudAV: N-Version Antivirus in the Network Cloud (2008, background): “The use of a diverse set of collection techniques means that the malware samples are more representative of threats faced by end hosts than malware datasets collected using only a single collection methodology such as Nepenthes [3].”
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic (2008, methodology): “Nepenthes [3] is a honeypot tool for automatically harvesting malware samples directly from the Internet.”