1. AdvancedAttackDetection TheOpenSource Way :-) Dominique KargAlienVault / OSSIMBSidesSF 2010

2. Whatthistalkisnotabout

3. The Play (AAA) Selfreminder: don‘tforgettellingwhatthisis all going to beabout.

4. Actors (Presentingtheplayers)

5. ZEUS Askyourlocalmalwareprovider.

6. TrojanEmulation/Analisys AlienVRTjaime.blasco@alienvault.com

7. NIDS http://www.snort.org

8. Host behavior/Anomalies Spade/Spada AlienVRTjaime.blasco@alienvault.com

9. HIDS Trend... http://www.ossec.net

10. Windows Policies Snare http://www.intersectalliance.org

11. Flows ... NFDump/NFSen Heavilymodifiedfor OSSIM

12. TrafficBehavior NTop http://www.ntop.org

13. Correlation OSSIM http://www.alienvault.com

14. Attack (Whattheuserdoes *not* see)

15. Installation Descriptiondetailesbased on: http://www.noryak.net/papers/zeus.pdf

16. System informationgathering Descriptiondetailesbased on: http://www.noryak.net/papers/zeus.pdf

17. CredentialStealing Descriptiondetailesbased on: http://www.noryak.net/papers/zeus.pdf

18. Environmentdiscovery Descriptiondetailesbased on: http://www.noryak.net/papers/zeus.pdf

19. Callinghome Descriptiondetailesbased on: http://www.noryak.net/papers/zeus.pdf

20. Web pageinjection Descriptiondetailesbased on: http://www.noryak.net/papers/zeus.pdf

21. Analysis (Whathappensbehindthescenes)

22. NIDS Events (Unreliable, signaturebased, false positives)

23. Host Behavior/Anomalies (Misconfiguredservices cause those)

24. HIDS Events (False positives, lessdangerousstuff, signaturebased)

25. Windows Policies 592 – Processcreation 593 – Processdestruction 577 – Privsystemcalls (Noisy to filter out)

26. Flows (Malware mightcontactnon-RBNhosts)

27. Trafficbehavior (Hard to tune, tons of false positives)

28. Correlation (The Key to success)

29. Conclusion (Obtainingreliablesecuritythroughbruteforce)

30. No single Pointof Failure

31. Easilyaddnewcomponents

32. Free! Cheap!

34. Trythis out

35. Improveit

36. Share it