Writing a SLIPS Module

Writing a SLIPS Module

Slips is a machine learning-based intrusion prevention system for Linux and MacOS, developed at the Stratosphere Laboratories from the Czech Technical University in Prague. Slips reads network traffic flows from several sources, applies multiple detections (including machine learning detections) and detects infected computers and attackers in the network. It is easy to extend the functionality of Slips by writing a new module. This blog shows how to create a new module for Slips from scratch.

Studying Cybercrime is Fun! An Overview of Five Years of Research Surrounding the Geost Botnet

Studying Cybercrime is Fun! An Overview of Five Years of Research Surrounding the Geost Botnet

This blog shows how a curious research experiment can lead a student into an interesting cybercrime investigation that contains weird -yet interesting- topics, such as understanding underground attackers, botnets, informal Internet forums, and the economy of encrypting malware-as-a-service.

New Slips version 0.8 is here!

New Slips version 0.8 is here!

In the last couple of months we have been busy continuing with the development of Slips, our behaviour machine learning system. And finally we published version 0.8, with crazy amount of features! You can download it from here https://github.com/stratosphereips/StratosphereLinuxIPS. And read the documentation here https://stratospherelinuxips.readthedocs.io/en/develop/.

The prevalence of DNS over HTTPS By Karel Hynek

The prevalence of DNS over HTTPS By Karel Hynek

Privacy-preserving DNS protocols like DNS over HTTPS (DoH), DNS over TLS (DoT), and DNS over QUIC (DoQ) have been around since 2014 but they have only recently been brought to the attention of the general public following Firefox’s announcement to make DoH a default.

Dissecting a RAT. Analysis of the Saefko RAT.

Dissecting a RAT. Analysis of the Saefko RAT.

This is the eighth blog of a series analyzing the network traffic of Android RATs from our Android Mischief Dataset [more information here], a dataset of network traffic from Android phones infected with Remote Access Trojans (RAT). In this blog post we provide the analysis of the network traffic of the RAT06-Saefko [download here]. The previous blogs analyzed Android Tester RAT, DroidJack RAT, SpyMax RAT, AndroRAT, HawkShaw, AhMyth and Command-line AndroRAT.

Dissecting a RAT. Analysis of the Command-line AndroRAT.

Dissecting a RAT. Analysis of the Command-line AndroRAT.

This is the seventh blog of a series analyzing the network traffic of Android RATs from our Android Mischief Dataset [more information here], a dataset of network traffic from Android phones infected with Remote Access Trojans (RAT). In this blog post we provide the analysis of the network traffic of the RAT08-command-line-AndroRAT [download here]. The previous blogs analyzed Android Tester RAT, DroidJak RAT, AndroRAT RAT, SpyMax RAT, AhMyth RAT and HawkShaw RAT.