SNE Master Research Projects 2008 - 2009
|
2004- 2005 |
2005- 2006 |
2006- 2007 |
2007- 2008 |
2008- 2009 |
2009- 2010 |
2010- 2011 |
2011- 2012 |
2012- 2013 |
2013- 2014 |
2014- 2015 |
2015- 2016 |
2016- 2017 |
2017- 2018 |
2018- 2019 |
2019- 2020 |
2020- 2021 |
2021- 2022 |
| Contact | TimeLine | Projects | LeftOver Projects | Presentations-rp1 | Presentations-rp2 | Objective | Process | Tips | Project Proposal |
Research Projects 1 and 2 (RP1 and RP2)
The course objective is to ensure that students become acquainted with problems from the field of practice through two short projects, which require the development of non-trivial methods, concepts and solutions. After this course, students should be able to:- Transform a roughly outlined problem into a carefully defined research question, supported by some level of reading up on the topic.
- Establish a feasible project schedule for answering the question.
- Conduct autonomous research to answer the question at hand, using literature searches, studying, experimentation and/or the development of software and hardware.
- Present solutions to a diverse audience (experts as well as non-experts).
- Defend solutions in debates.
- Provide an appropriate report
Intro slides this year: cdl-2008-10-08.pdf
Process
- Selection
- Preferably do not choose subjects that will be covered in subsequent courses.
- working alone or in pairs
- Preference for pairs because:
-
- students can help each other when one gets stuck in a problem...
- investigate more solutions in parallel
- learn to collaborate
- contribution of each student must be clear in report and presentation
- However, doing an RP alone is also allowed
- At the presentations pairs get 30 minutes, singles get 20 minutes.
- Feedback during RP
- During both RP1 as RP2 a group meeting on the third monday afternoon 15h00.
- Purpose is to exchange progress information and discuss potential or real encountered problems.
- fifth week
- Optionally week 5 of the RP in June is available to continue and finish research.
- Presentation will be on wednesday, report must be submitted by friday of the fifth week.
- RP order
- A student must succesfully complete RP1 before starting RP2.
- RP1 and RP2 can be done arbitrarly in January or June.
- If failed for RP2, it is allowed to redo a RP2 at any time.
- Evaluation
- Advice from the supervisor about the research done on location.
- Advice on presentation and report is welcome.
- this information must be delivered by supervisor before end of fifth week.
- report and presentation are evaluated by the OS3 team.
- Marks for presentatie are determined before end of fifth week.
- Evaluation and if needed corrections of report can take up to 6 weeks (pending holidays in july.
- If rest is positive there is an opportunity to correct the report.
- average and the mark for report must be 6 or more and the other marks must be more than or equeal 5.
- Publication of results
- the marks will be posted on blackboard.
- Colloquia
- We aim to schedule colloquia about research in computer science to give more context for the RP's.
- Communication
- All communication happens using email addresses from either OS3 or UVA.
Projects
Here is a list of student projects for Jan 2009 and/or june 2009. In a futile lightweight way to prevent spamming I replaced "@" by "=>" below.Color:
- yellow = currently chosen/active project
- light blue = research plan in received
- green = report or presentation is received (does not indicate a grade!)
| # |
title summary |
supervisor students |
R P |
1 / 2 |
| 2 |
Online Banking: Attacks & Defences.Door de snelle opkomst van een nieuwe generatie trojans, die voortborduurt op het concept van de man-in-the-middle aanval die actief verkeer herschrijft in twee richtingen, moeten alle klassieke authenticatiemechanismen (password, TAN lijst, SMS TAN, (a)synchrone tokens, challenge/response tokens, signing tokens, PKI) als gebroken beschouwd worden voor situaties waarbij het het eindpunt niet fatsoenlijk onder controle is. Kortweg: malware op de PC van de eindgebruiker breekt iedere authenticatie.De conclusie moet zijn dat een sterkte authenticatie anno 2008 niet meer is dan een onderdeel in de beveiliging van een on-line transactie; zoals een firewall alleen een netwerk niet veilig maakt, zo maakt een sterke authenticatie alleen een on-line transactie niet veilig. Om wel tot een acceptabel beveiligingsniveau te komen, zullen de we, zoals vaak in IT beveiliging, onze toevlucht moeten nemen tot diverse lagen van beveiliging. Hierbij valt te denken aan de volgende drie lagen:
Onderzoeksopdracht:
|
Jan Joris Vereijken Kino Verburg Dominic van den Ende <Dominic.vandenEnde=>os3.nl> Tom Hendrickx <tom.hendrickx=>os3.nl> |
R P |
2 |
| 5 |
Verschillende toepassingen voor virtualisatie.Er zijn nogal wat virtualisatie oplossingen tegenwoordig beschikbaar, zoals bijvoorbeeld Xen, VMWare, KVM, Virtualbox, QEMU en Bochs. Virtualisatie kan voor vele doeleinden worden gebruikt, zoals bijvoorbeeld server consolidatie, separatie van client omgevingen, prototyping en virtual hosting. Welke voor- en nadelen zijn aan deze virtualisatietechnieken verbonden in combinatie met de diverse toepassingsgebieden, met name op het gebied van veiligheid en stabiliteit ? |
Fred Mobach <fred=>mobach.nl> Dominic van den Ende <dominic.vandenende=>os3.nl> |
R P |
1 |
| 6 |
Implementing OpenLISP with LISP + ALT.The growth of the Internet, both in the number of connected hosts and the number of Internet Service Providers (ISPs), has resulted in scalability problems in routing traffic over the Internet infrastructure. Routing tables are growing exponentially and stability is decreasing. A solution to these problems is essential to guarantee future growth of the Internet in various dimensions, i.e, hosts, ISPs, bandwidth, responsiveness, ...The Locator/ID Separation Protocol (LISP) is a proposed solution to reduce the routing table size, support mobility with survivability, and include traffic engineering capabilities. In this project, an openLISP prototype implementation will be installed at NLnet Labs. The deployed system will be tested and evaluated in a real-world setting. |
Benno Overeinder <benno=>NLnetLabs.nl> Attilla De Groot <attilla.degroot=>os3.nl> |
R P |
1 |
| 7 |
Browser Security.Vulnerabillities in browsers. |
Marc Smeets <Smeets.Marc=>kpmg.nl> Hans Ijkel <IJkel.Hans=>kpmg.nl> Wouter van Dongen <Wouter.vanDongen=>os3.nl> |
R P |
1 |
| 10 |
Stream Control Transport Protocol.FreeBSD supports the SCTP protocol (RFC 4960) which provides connections with multiple streams between multiple interfaces. In this project the features of SCTP will be investigated. Simple SCTP client and server programs need to be written. With these programs various features of the protocol can be investigated. E.g., what happens when there are two paths between the server and the client that are both used by SCTP and one of the paths is interrupted. The FreeBSD implementation also supports dynamic addressing, where addresses can be added or deleted from existing stream associations. Investigate how this works and what can be done with it. |
Ronald van der Pol <Ronald.vanderPol=>rvdp.org> Taarik Hassanmahomed <Taarik.Hassanmahomed=>os3.nl> |
R P |
1 |
| 15 |
802.1ah in NetherLight; an application proposal.NetherLight is the Optical Exchange Point in the Netherlands. Customers can interconnect their lightpaths via NetherLight. NetherLight consists of SDH/SONET equipment and Ethernet equipment. Lightpaths can be SDH/SONET circuits or Ethernet VLANs. The Ethernet switch of NetherLight is currently configured as a traditional switch with tagged and untagged ports and VLANs. The major drawback of this is that there is no separation between customer VLAN IDs and NetherLight VLAN IDs and therefore careful planning of VLAN IDs between NetherLight and all customers is needed. 802.1ah (aka mac-in-mac) is a new Ethernet technology that makes it possible to separate the VLAN IDs of NetherLight (backbone VLAN IDs) from the VLAN IDs from customers (customers VLAN IDs).This assignment consists of several parts:
|
Ronald van der Pol <Ronald.vanderPol=>rvdp.org> Mark Meijerink <mark.meijerink=>sara.nl> Sevickson Kwidama <Sevickson.Kwidama=>os3.nl> |
R P |
2 |
| 16 |
Ad-hoc trust associations with Trust Anchor Repositories.This project will look closely at originally global trust model initially developed in DNSSEC and compare it with the recently proposed and actively discussed by RIPE and ICANN ISSAC community the island based trust model. The global trust model assumes that the root server willsign keys of all top level zones and all trust model is based on the trust to the root signer. But when it closer comes to implementing DNSSEC by national TLD registries, the issue of trust is becoming more and more critical as some governments will be not happy to depend on their TLD root signing by external bodies. Recently proposed idea of creating Trust Anchor Repository (TAR) allows maintaining islands of trust hierarchies like national DNSSEC implementations. To facilitate DNSSEC implementation, ICANN agreed to run Interim TAR (ITAR) to zone/registries that have already implemented or will implement soon DNSSEC soon. The project will look closely at both global and island based DNSSEC trust models and compare them and next evaluate some possible scenarios for further development of the DNSSEC with either models. Another goal of this project maybe to discuss using future DNSSEC infrastructure for creating dynamic security association in on-demand network services provisioning. Information: RFCs, IETF DNSEXT WG drafts, ICANN Security and Stability Advisory Committee (SSAC) reports. |
Yuri Demchenko <Y.Demschenko=>uva.nl> Stefan Roelofs <Stefan.Roelofs=>os3.nl> |
R P |
2 |
| 18 |
Troubleshooting Grid authentication from the client side.Het probleem : men probeert gebruik te maken van een grid service, maar tijdens de poging gaat er "iets" mis met authz/authn. Meestal is het niet makkelijk om achter te komen wat het probleem is. Je hebt :
|
Jan Just Keijser <janjust=>nikhef.nl> David Groep <davidg=>nikhef.nl> Adriaan van der Zee <adriaan.vanderzee=>os3.nl> |
R P |
1 |
| 20 |
Xen Hypervisor security in VM isolation.Is it possible to breach the XEN hypervisor security in VM isolation and what are the risks and implications if this happens. Xen is a virtual machine monitor for IA-32, x86, x86-64, IA-64 and PowerPC 970 architectures. Modified versions of Linux, NetBSD and Solaris can be used as the dom0. Unmodified versions of Microsoft Windows and other proprietary operating systems can also be used as guests if the CPU supports Intel VT or AMD V technologies. Both technologies have different security and both need to be researched. |
Fred Mobach <fred=>mobach.nl> Yanick de Jong <Yanick.deJong=>os3.nl> |
R\ P |
1 |
| 21 |
Implementation difference between DNScurve and DNSsec.DNSCurve uses high-speed high-security elliptic curve cryptography to add link-layer security on top of standard DNS, in a way that's simple to implement and administer and scales well. What are the benifits and disadvantages of dnssec and dnscurve implementations in short and long terms. |
Fred Mobach <fred=>mobach.nl> Cornel de Jong <Cornel.deJong=>os3.nl> |
R P |
2 |
| 22 |
XEN VGA passthrough.Is it possible to run a virtualmachine (domU) on a xen hypervisor which uses the original VGA card in the system? With Intel VT-D it's possible to give a domU direct access to a PCI(e) device in a way that it can use native drivers to make use of the device. Is this also possible with the VGA card in a way that you can run windows as a virtual machine with the advantages that VGA cards offer these days on top of a Linux / Unix based dom0? |
Mendel Mobach <mendel=>mobach.nl> Yuri Schaeffer <Yuri.Schaeffer=>os3.nl> |
R P |
1 |
| 23 |
IPv4 ARP/IPv6 ND "Sponge" Daemon.IP network nodes use ARP (IPv4) or ND (IPv6) protocol messages to discover the hardware address (MAC) to map an IP address to. These messages are by definition multicast to all connected nodes. On large shared media where many nodes communicate with each other, such as the Ethernet platform at AMS-IX, the (temporary) unavailability of a connected node (BGP peer) may result in a storm of these ARP and ND messages.To reduce these storms, we developed an "ARP sponge" that runs as a Linux/UNIX daemon and spoofs ARP replies when the rate of queries exceeds a threshold. The current implementation has a number of limitations (such as being single-threaded and working for IPv4 only). We are looking at setting up a project to re-implement this software, extending it to IPv6 ND and adding some other features. |
Steven Bakker <steven.bakker=>ams-ix.net> Niels Sijm <niels.sijm=>os3.nl> Marco Wessel <Marco.Wessel=>os3.nl> |
R P |
2 |
| 25 |
Feasibility study Network Access Control (NAC).This company in the technical automation branch for material handling systems would like to see a feasibility study for the introduction of NAC on their internal network. Research questions are:
|
Marcel Verbruggen <Marcel.Verbruggen=>vanderlande.com> Stefan Roelofs <Stefan.Roelofs=>os3.nl> |
R P |
1 |
| 26 |
Universal Plug and Play Eventing vulnerabilities.Over the past few years I have been digging into Universal Plug and Play vulnerabilities. My research has mostly been about vulnerabilities in code that processes UPnP SOAP requests and has been documented on http://www.upnp-hacks.org/. One part of the UPnP protocol, eventing, has not been properly investigated yet, due to lack of time.The eventing part of the protocol offers a new angle of attacks. The UPnP eventing system is based on HTTP, GENA and XML. It works by registering a callback URL with a device which events should be sent to. Event changes are sent to the callback URL in XML format. The scope of research would be:
|
Armijn Hemel <armijn=>uulug.nl> Joeri Blokhuis <joeri.blokhuis=>os3.nl> |
R P |
1 |
| 27 |
Top40 cache compared to LRU and LFU.Door middel van een in-house ontwikkeld Cache Replacement Script (gebaseerd op least-frequently-used algoritme) word de distributie over de storage bepaald (zowel disks als geheugen). Graag zouden we een onderzoek laten doen naar de effectiviteit en efficientie van het algoritme en indien nodig een voorstel naar verbeteringen van het script door optimalisatie of andere algoritmes (Het huidige script is geschreven in Perl). |
Dick Snippe <dick.snippe=>tech.omroep.nl> Alain van Hoof <alain.vanhoof=>os3.nl> |
R P |
1 |
| 28 |
Research on OpenID and its integration within the GravityZoo framework.Wat is OpenID? (http://openid.net): OpenID eliminates the need for multiple usernames across different websites, simplifying your online experience. You get to choose the OpenID Provider that best meets your needs and most importantly that you trust. At the same time, your OpenID can stay with you, no matter which Provider you move to. And best of all, the OpenID technology is not proprietary and is completely free. For businesses, this means a lower cost of password and account management, while drawing new web traffic. OpenID lowers user frustration by letting users have control of their login.For geeks, OpenID is an open, decentralized, free framework for user-centric digital identity. OpenID takes advantage of already existing internet technology (URI, HTTP, SSL, Diffie-Hellman) and realizes that people are already creating identities for themselves whether it be at their blog, photostream, profile page, etc. With OpenID you can easily transform one of these existing URIs into an account which can be used at sites which support OpenID logins. Onderzoeksvragen die hierbij aan bod komen:
|
Marcel van Birgelen <marcel.b=>gravityzoo.com> Jarno van de Moosdijk <Jarno.vandeMoosdijk=>os3.nl> |
R P |
1 |
| 29 |
Desktop sharing with SIP.Applicaties zitten vaak 'gevangen' in schermen op de desktop van de gebruiker. Als je iemand een demonstratie wilt geven van een bepaalde applicatie, moet hij die in de praktijk zelf (laten) installeren en vervolgens de applicatie lokaal draaien - met alle vertraging, rechtenkwesties en foutgevoeligheden die dat oplevert van dien. Bovendien is het nogal omslachtig, je moet iemand een bestand mailen in een mogelijk voor hem of haar exotisch formaat waarna men het aan deandere zijde moet openen. Dan is nog steeds niet zeker of wat de ene partij ziet hetzelfde is als wat de andere partij ziet. In het geval van verschillende besturingssystemen (bv. Apple OS X, Linux en Microsoft Windows) of bij gebruik van proprietary omgevingen tussen partners is het delen van applicaties zelfs bijzonder lastig. De omslachtige manier van werken (het sturen van uitnodigingen van remote desktopsessies via mail) maakt het te moeizaam voor gebruik door leken. Voor het opzetten van een sessie zijn internetstandaarden beschikbaar. Met name het SIP-protocol - dat momenteel hoofdzakelijk (en in steeds sterkere mate) gebruikt wordt voor internettelefonie - is feitelijk een generieke brug tussen mensen die het mogelijk maakt om gebruiker X en Y, waar ze ook ter wereld zitten, te localiseren en met ze te communiceren via een sessie naar keus. Je 'belt' simpelweg iemands contactgegevens en wanneer zij jou als gesprekspartner accepteren kun je een sessie met ze opzetten. In combinatie met een aantal bestaande (in open source-toepassingen ruim beschikbare) protocollen als FreeNX,VNC, X11 is het goed mogelijk om via SIP schermen vrijelijk met anderen in een virtueel team uit te wisselen. SIP lost het klassieke bereikbaarheidsprobleem aan beide kanten van de communicatielijn op. Dit doet het al zeer succesvol voor VoIP-telefonie, maar het kan met hetzelfde gemak (via een laagdrempelige, zeer eindgebruikersvriendelijke adressering, nl. iemands mailadres) worden gebruikt voor willekeurige toepassingen. Ieder venster op je desktop wordt op deze manier een realtime brug naar een andere monitor (of Cave of projector) van een andere gebruiker, waar desgewenst de betreffende persoon kan meekijken met wat jij doet of juist het werk doet terwijl de initiator van de sessie toeziet. Natuurlijk kunnen er meerdere verbindingen parallel en instantaan worden opgezet, zodat het delen van applicaties tussen virtuele teams tijdens bijvoorbeeld teleconferences triviaal wordt (en dus losgekoppeld wordt van software die alleen lokaal draait). Ondertussen is er eventueel een spraak en/of video-verbinding die meteen mee kan worden opgezet, waardoor men een en ander toe kan lichten om samen het probleem op te lossen. Daarmee is het de laatste missing link om toepassingen met een grafische schil vrij over het internet te laten stromen tussen desktops en mobiele devices van gebruikers: ofwel de global desktop. Wat moet er gebeuren?
|
Michiel Leenaars <michiel=>nlnet.nl> Willem Toorop <willem.toorop@os3.nl> |
R P |
1 |
| 32 |
DNSCurve Analysis.Please see DNSCurve-analysis.pdfCompany profile. |
J. Scheerder <jeroenscheerder=>on2it.eu> Michiel Timmers <michiel.timmers=>os3.nl> |
R P |
1 |
| 37 |
Design and development of a SAN Alarm system.The operations department of KLM Information Services is responsible for the process of acquisition, implementation and upgrade of the technology infrastructure supporting Air France ? KLM business applications. An important part of the technology infrastructure comprises of a Storage Area Network (SAN), that is used by a variety of platforms (Unix (AIX), Linux (RedHat), MS Windows and z/OS (Mainframe). In the past, applications that rely on the SAN infrastructure, experienced serious downtime related to severe SAN performance degradation. Applications experienced disk errors and the SAN fabric switches showed buffer discards. Although several problem symptoms are visible at individual platform levels, it took operations a significant amount of time to discover the nature of the phenomena in order to react accordingly. The aim of this project is to reduce the time to react on such a phenomena (or even help prevent such situation) by introducing a SAN Alerting System (SAS). This system should reliably detect performance degradation of the SAN fabric caused by certain traffic patterns and summarize the state of the SAN into a simple to interpret gauge, capable of acting as a signal to initiate corrective measures. The result should be a concept, augmented by a prototype solution. |
"Gommans, LHM - SPLXM" <Leon.Gommans=>klm.com> Adriaan van der Zee <adriaan.vanderzee=>os3.nl> Yanick de Jong <yanick.dejong@os3.nl> |
R P |
2 |
| 38 |
Cloud Computing.The promise of cloud storage and cloud computing is the "infinite" scalability and high reliability the model offers, usually using cheap hardware. Storage and compute resources for "normal" IT become available as an infrastructural service, for which a pay-as-you-go financial model is not uncommon. The Amazon webservices (S3/EC2) are a prime example of implementing this model. Google implements a similar model in its backend, and various storage software and hardware vendors are following suit.In the context of the constituency of an NREN, the national higher education and research community, the cloud model allows thinking about campuses without physical hardware which would offer interesting benefits: economy of scale, storage/computing as an infrastructural service for outsourcing physical iron headaches. The cloud model poses many questions. How does one build a cloud? How to deal with reliability, scalability, billing? What economic models could be used? What are the economic assumptions behind the cloud? How is quality of service assured, both from a technical and an organisational/policy/economical point of view? What are the limitations of the cloud model? How is the cloud model different from the grid and utility computing models? How can/do clouds interconnect? What differences, if any, show up when the cloud model is applied to various contexts: research, educational data centers, commercial environments. Can data and compute resources flow across borders without problems? The cloud is rather foggy at the moment. The purpose of this RP1 project is to shed some light on it, and to carefully consider how the concept can be used in the context of the higher education and research community in general and of a NREN in particular. LogisticsSupervisor/contact: Jan Meijer, UNINETT, Trondheim (Norway)Physical materialisation of student week 1: at home/SNE lab week 2: in Trondheim, Norway week 3: in Trondheim, Norway week 4: at home/SNE lab Meetings between supervisor and student in week 1 and week 4 will be held using phone/skype/video meetings, as the circumstances allow and demand. The presentation will be observed through a video link. It would be good to make a reservation for one of the high quality SURFnet VC units. Or to stream it over 4K video ;) |
Jan Meijer <Jan.Meijer=>uninett.no> Tom Hendrickx <tom.hendrickx=>os3.nl> |
R P |
1 |
| 41 |
The DFRWS 2009 Challenge.The DFRWS 2009 Challenge focuses on the development of tools and techniques for analyzing Playstation 3?s (PS3s). The Playstation 3 is a powerful, Cell processor-based system that can run both its native OS (which has significant DRM features that also thwart forensic investigation) and modern versions of Linux. This challenge focuses on the Linux and network aspects of PS3s, and does not touch the DRM protected data. The challenge scenario requires analysis of a physical memory dump, filesystem images, and network traces involving 2 PS3?s and a Playstation Portable (PSP).http://www.dfrws.org/2009/challenge/index.shtml |
Ruud van Baar <ruud=>holmes.nl> Wouter van Dongen <Wouter.vanDongen=>os3.nl> Alain van Hoof <alain.vanhoof=>os3.nl> |
R P |
2 |
| 42 |
Car authentication.Een moderne auto open je met een remote keyless entry (RKE) device. Er zijn diverse systemen in gebruik, diverse RF gebaseerde systemen (de traditionele autosleutel+afstandsbediening met een knopje), maar ook smartcards waarbij aanwezigheid in de buurt van je auto voldoende is voor het ontgrendelen van portieren. Onlangs toonden autofabrikanten zelfs conceptcars met bluetooth als RKE systeem, dit maakt het mogelijk je auto te ontgrendelen met bijvoorbeeld je telefoon.Voer een onderzoek uit naar RKE systemen. Beantwoord in je onderzoek de volgende vragen:
|
Hans Ijkel <IJkel.Hans=>kpmg.nl> Pieter Ceelen <Ceelen.Pieter=>kpmg.nl> Stan Hegt <Hegt.Stan=>kpmg.nl> Jarno van de Moosdijk <jarno.vandemoosdijk=>os3.nl> Dick Visser <dick.visser=>os3.nl> |
R P |
2 |
| 44 |
IP multicast routing on AMS-IX.IP multicast is a method of forwarding IP datagrams to a group of interested receivers. Its typical use lies in applications with one sender and many receivers, such as one-way audio or video streaming. IP multicast can be deployed inside a network, or between multiple networks. For routing of multicast traffic between multiple networks Provider-Independent Multicast (PIM) is used.The switches on the current AMS-IX platform have no knowledge about which connected routers are part of a multicast group. Because of this, multicast traffic on the platform is currently treated the same as broadcast traffic, and forwarded out on every port in a VLAN (except for the port on which the traffic arrived). In order to limit the amount of unwanted flooding of multicast traffic, members that wish to exchange multicast traffic are configured in a separate VLAN for this purpose. Currently the amount of multicast traffic exchanged on the AMS-IX platform is very low. New developments in the field of on-demand video may cause an uptake in this. In order to facilitate this, the AMS-IX switches will need to be aware of multicast traffic patterns, and only forward multicast streams to interested recipients, instead of all devices in a VLAN. A technology called PIM Traffic Snooping was designed for this purpose. Goal of this research project is to investigate how inter-domain IP multicast works, and to test the possibility of using of PIM Traffic Snooping on the AMS-IX platform. All tests will need to take into account both the current AMS-IX Layer-2 platform, as well as the future platform based on MPLS/VPLS, which will be deployed later this year. |
Steven Bakker <steven.bakker=>ams-ix.net> Attilla De Groot <attilla=>attilla.nl> Yuri Schaeffer <yuri.schaeffer=>os3.nl> |
R P |
2 |
| 46 |
Busting the ghost on the web: real time detection of drive-by-infections.Drive-by-infecties zijn geautomatiseerde malware infecties die zonder tussenkomst van de gebruiker verspreid worden via in principe bonafide, maar gecompromitteerde websites. Deze malware maakt gebruik van beveiligingslekken in de browser of plugins zoals ActiveX of Flash componenten om zo het systeem van de gebruiker ongemerkt te infecteren.IDS systemen die gebruik maken van signature gebaseerde detectie in netwerkdata zijn vanwege hun statische karakter minder geschikt voor het herkennen van deze snel vari�rende en vaak nog onbekende dreigingen. Onderzoek de mogelijkheden voor het detecteren van drive-by infecties door het analyseren van afwijkingen in metadata van HTTP request en response headers, en plotselinge wijzigingen van dergelijke data gedurende een sessie. Welke verschillen zijn er in deze metadata te vinden tussen normale legitieme sessies en sessies waarin een drive-by infectie plaatsvindt? Dit zonder gebruik te maken van (full) content inspectie. Doelstellingen
ScopeOnderzoeken of het mogelijk is om aan de hand van http request/response metadata te zien of er op dat moment een drive-by-infection plaatsvindt. Metadata bevat, maar is niet beperkt tot timing van requests/responses, geografische locatie van de opgevraagde resource, bestandsnamen etc. Het onderzoek zal zich niet richten op de inhoud van de http responses, maar uitsluitend op de metadata. |
Bart Roos <roos=>fox-it.com> Sander Peters <peters=>fox-it.com> Michael van Kleij <michael.vankleij=>os3.nl> Thijs Kinkhorst <thijs.kinkhorst=>os3.nl> |
R P |
2 |
| 47 |
In depth abuse statistics.Internet abuse and threats are usually presented by given the total amount of issues a organization like Spamhaus receives, which result in a worst top N list. These statistics don't take the network size, type and architecture into consideration which could give a inaccurate impression of the real problem. Smaller networks for example won't make it to this list although there percentage of abuse in correlation with there network size could be far higher. Internet criminals could hide behind these smaller networks because they are not flagged to be a threat.Research question: Show how network size, type and architecture effect the amount of abuse reports and security threats that are available. Task: By using CBL (composite blocking list) and other DNSBL related databases you can get a total amount of abuse that is out there. Use this information to generate statistics for the amount of abuse in correlation with network size (Regional Internet Registry for continent specific/ ISP for country specific) Network architecture (NAT) and network type (Broadband / slow dial-up connections). For determining the real network size its not trustworthy to look at what CIDR/AS a specific IP address belongs to because one IP address can be used by multiple host using NAT solutions. By determining what the network architecture is of a reported IP addresses you should get a more realistic view about the abuse of a specific reported network. One possible approach is to analyze end connectivity of a particular network by sending n ICMP messages randomly across that network block. Nessus and similar tools that use a fingerprint databases can be used to determine if a IP address is used as an end node or by a NAT appliance and intercepting proxy servers. |
Carel van Straten <carel=>spamhaus.org> JP Velders <Jan-Philip.Velders=>os3.nl> Michiel Timmers <michiel.timmers=>os3.nl> Arthur van Kleef <arthur.vankleef=>os3.nl |
R P |
1 |
Contacts
Cees de LaatTimeLine
RP1:- Wednesday Oct 8th 2008, 10h15: Introduction to the Research Projects.
- Dec xth 2008, xxh00: Detailed discussion on finally chosen subjects for RP1.
- Monday Jan 5th - Friday jan 30th 2009: Research Project 1.
- Wednesday Feb 4th: Presentations RP1 in Z009 @ CWI.
- Wednesday may 15th 2009, 10h00: Detailed discussion on finally chosen subjects for RP2.
- Monday Jun 1th - Friday Jun 26th 2009: Research Project 2.
- Wednesday Jul 1th: Presentations RP2 in Z011 @ CWI.
Presentations-rp1
| Wednesday feb 4th in room z009 at Kruislaan 413, NL-1098 SJ Amsterdam. |
||||
| Time |
#RP |
Title |
Name(s) |
RP |
| 09h55 | Welcome, introduction. | Cees de Laat | ||
| 10h00 | 5 |
Verschillende toepassingen voor virtualisatie. | Dominic van den Ende | |
| 10h20 |
6 |
Implementing OpenLISP with LISP + ALT. | Attilla de Groot | |
| 10h40 |
7 |
Browser Security | Wouter van Dongen | |
| 11h00 |
10 |
Stream Control Transport Protocol | Taarik Hassanmahomed | |
| 11h20 |
Pauze |
|||
| 11h40 |
15 |
Sevickson Kwidama | 802.1ah in NetherLight; an application proposal. | |
| 12h00 |
18 |
Adriaan van der Zee | Troubleshooting Grid Authentication from the client side. | |
| 12h20 |
20 |
Yanick de Jong | Xen hypervisor security in VM isolation. | |
| 12h40 |
29 |
Willem Toorop | Desktop sharing with SIP. |
|
| 13h00 | Lunch | |||
| 13h40 |
32 |
Michiel Timmers | DNSCurve Analysis | |
| 14h00 |
25 |
Stefan Roelofs | Feasibility study Network Access Control (NAC). |
|
| 14h20 |
26 |
Joeri Blokhuis | Universal Plug and Play Eventing vulnerabilities. | |
| 14h40 | 27 |
Alain van Hoof | Top40 cache compared to LRU and LFU. | |
| 15h00 | Pauze | |||
| 15h20 | 28 |
Jarno van de Moosdijk | Research on OpenID and its integration within the GravityZoo framework. | |
| 15h40 |
22 |
Yuri Schaeffer | XEN VGA passthrough. | |
| 16h00 | 24 |
Arthur van Kleef | Using XEN Technology for Green.IT. | |
| 16h20 |
38 |
Tom Hendrickx | Cloud computing. | |
| 16h40 | Evaluatie, afsluiting. | Cees de Laat & OS3 team | ||
| 16h55 |
End | |||
Presentations-rp2
Program: (see end of page for the verifiable random ordering)| Wednesday july 1th, 2009 in room z011 at Kruislaan 413, NL-1098 SJ Amsterdam. | ||||
| Time |
#RP |
Title |
Name(s) |
RP |
| 10h00 | Welcome, introduction. | Cees de Laat | ||
| 10h10 | 44 |
IP multicast routing on AMS-IX. | Attilla De Groot, Yuri Schaeffer | 2 |
| 10h40 |
46 |
Busting the ghost on the web: real time detection of drive-by-infections. | Michael van Kleij, Thijs Kinkhorst | 2 |
| 11h10 |
Pauze | |||
| 11h30 |
37 |
Design and development of a SAN Alarm system. | Adriaan van der Zee, Yanick de Jong |
2 |
| 12h00 |
23 |
IPv4 ARP/IPv6 ND "Sponge" Daemon. | Niels Sijm, Marco Wessel |
2 |
| 12h30 | Lunch | |||
| 13h30 |
42 |
Car Authentication. | Jarno van de Moosdijk, Dick Visser |
2 |
| 14h00 |
2 |
Online Banking: Attacks & Defences. | Dominic van den Ende, Tom Hendrickx |
2 |
| 14h30 |
21 |
Implementation difference between DNScurve and DNSsec. | Cornel de Jong | 2 |
| 14h50 |
Pauze | |||
| 15h20 |
16 |
Ad-hoc trust associations with Trust Anchor Repositories. | Stefan Roelofs |
2 |
| 15h40 |
47 |
In-depth Abuse Statistics. | Michiel Timmers, Arthur van Kleef | 1 |
| 16h10 |
41 |
The DFRWS 2009 Challenge. | Wouter van Dongen, Alain van Hoof |
2 |
| 16h40 | Afsluiting | Cees de Laat | ||
| 17h00 |
Borrel | |||
(**) Random ordering: See RFC2777:, the seed is the seat number plus flight number on my trip to Malaga for TNC2009.
~/f77/nomcom> nomcom
Type size of pool:
warning: this program uses gets(), which is unsafe.
(or 'exit' to exit) 11
Type number of items to be selected:
(or 'exit' to exit) 10
Approximately 3.6 bits of entropy needed.
Type #1 randomness or 'end' followed by new line.
Up to 16 integers or the word 'float' followed by up
to 16 x.y format reals.
22,6115
22
Type #2 randomness or 'end' followed by new line.
Up to 16 integers or the word 'float' followed by up
to 16 x.y format reals.
end
Key is:
22./
index hex value of MD5 div selected
1 3A4CB9F962F2C6911B425EE2C0DE7FB3 11 -> 1 <-
2 5ECC3C8E69C519510DBC46D892DA96AC 10 -> 8 <-
3 E250F70303543DC132283AADAE2B2630 9 -> 9 <-
4 FC40F869BEEA2F8FEC927DCA16FEB2EB 8 -> 5 <-
5 C2BCC164BDAA151F7FAB8669FDD1736C 7 -> 4 <-
6 BC20FDF40AFB8B60EF6B4F694FE9AED5 6 -> 7 <-
7 1FAACC0F14B6D9968D48E161E2906A47 5 -> 3 <-
8 284FDB3E264FC106F73F4EB8B88E4A0A 4 -> 10 <-
9 DDD3A23DACF9265A530EC2481A5C5FB9 3 -> 2 <-
10 02817E12809907FAA7CF0E570BFB275E 2 -> 6 <-
Done, type any character to exit.