The Experts below are selected from a list of 723 Experts worldwide ranked by ideXlab platform

Bruce Potter - One of the best experts on this subject based on the ideXlab platform.

  • chapter 5 Host Integrity Monitoring with open source tools
    2005
    Co-Authors: Brian Wotring, Bruce Potter
    Abstract:

    Osiris and Samhain are the two most popular and widely deployed open source Host Integrity Monitoring products. Each has an agent-based deployment model providing detailed reports about changes to various aspects of a Host's environment, including files, network ports, users, groups, kernel modules, kernel state, and user login events. Although they both share the same goals, Osiris and Samhain have different feature sets; therefore, some environments are going to favor one over the other. Osiris consists of three distinct components: a command-line client, a management console, and a scan agent. A scan agent is deployed onto every Host that is to be monitored. A single management console stores all of the scan data, the scan agent configurations, and logs; manages scheduling; and handles notifications—it is the brains of the system. The command-line client communicates only with the management console, and only the management console communicates with scan agents. Samhain consists of three components: a console, a server, and a scan agent (often called the client).The agents are deployed onto every Host that is to be monitored. A single server acts as a central location for logs, scan configurations, and scan data. The console is a Web-based control center written in hypertext preprocessor (PHP) that presents a unique identifier (UI) that can be used to update databases or edit scan configurations. An optional component is a relational database server.

  • Host Integrity Monitoring using osiris and samhain
    2005
    Co-Authors: Brian Wotring, Bruce Potter, Marcus Ranum, Rainer Wichmann
    Abstract:

    Chapter 1: Fundamentals Chapter 2: Understanding The Terrain In order to be effective at understanding what to monitor Chapter 3: Threats Chapter 4: Planning The key to obtaining the most out of the adoption of Host Integrity tools Chapter 5: Osiris Chapter 6: Samhain Chapter 7: Analysis and Response Appendix A: Monitoring Linksys Devices Appendix B: Advanced Strategies

Brian Wotring - One of the best experts on this subject based on the ideXlab platform.

  • chapter 5 Host Integrity Monitoring with open source tools
    2005
    Co-Authors: Brian Wotring, Bruce Potter
    Abstract:

    Osiris and Samhain are the two most popular and widely deployed open source Host Integrity Monitoring products. Each has an agent-based deployment model providing detailed reports about changes to various aspects of a Host's environment, including files, network ports, users, groups, kernel modules, kernel state, and user login events. Although they both share the same goals, Osiris and Samhain have different feature sets; therefore, some environments are going to favor one over the other. Osiris consists of three distinct components: a command-line client, a management console, and a scan agent. A scan agent is deployed onto every Host that is to be monitored. A single management console stores all of the scan data, the scan agent configurations, and logs; manages scheduling; and handles notifications—it is the brains of the system. The command-line client communicates only with the management console, and only the management console communicates with scan agents. Samhain consists of three components: a console, a server, and a scan agent (often called the client).The agents are deployed onto every Host that is to be monitored. A single server acts as a central location for logs, scan configurations, and scan data. The console is a Web-based control center written in hypertext preprocessor (PHP) that presents a unique identifier (UI) that can be used to update databases or edit scan configurations. An optional component is a relational database server.

  • Host Integrity Monitoring using osiris and samhain
    2005
    Co-Authors: Brian Wotring, Bruce Potter, Marcus Ranum, Rainer Wichmann
    Abstract:

    Chapter 1: Fundamentals Chapter 2: Understanding The Terrain In order to be effective at understanding what to monitor Chapter 3: Threats Chapter 4: Planning The key to obtaining the most out of the adoption of Host Integrity tools Chapter 5: Osiris Chapter 6: Samhain Chapter 7: Analysis and Response Appendix A: Monitoring Linksys Devices Appendix B: Advanced Strategies

Rainer Wichmann - One of the best experts on this subject based on the ideXlab platform.

  • Host Integrity Monitoring using osiris and samhain
    2005
    Co-Authors: Brian Wotring, Bruce Potter, Marcus Ranum, Rainer Wichmann
    Abstract:

    Chapter 1: Fundamentals Chapter 2: Understanding The Terrain In order to be effective at understanding what to monitor Chapter 3: Threats Chapter 4: Planning The key to obtaining the most out of the adoption of Host Integrity tools Chapter 5: Osiris Chapter 6: Samhain Chapter 7: Analysis and Response Appendix A: Monitoring Linksys Devices Appendix B: Advanced Strategies

Marcus Ranum - One of the best experts on this subject based on the ideXlab platform.

  • Host Integrity Monitoring using osiris and samhain
    2005
    Co-Authors: Brian Wotring, Bruce Potter, Marcus Ranum, Rainer Wichmann
    Abstract:

    Chapter 1: Fundamentals Chapter 2: Understanding The Terrain In order to be effective at understanding what to monitor Chapter 3: Threats Chapter 4: Planning The key to obtaining the most out of the adoption of Host Integrity tools Chapter 5: Osiris Chapter 6: Samhain Chapter 7: Analysis and Response Appendix A: Monitoring Linksys Devices Appendix B: Advanced Strategies

Kumar Pranjal - One of the best experts on this subject based on the ideXlab platform.

  • Detection Techniques of Rootkits
    Imperial journal of interdisciplinary research, 2016
    Co-Authors: Shrikant Bhardwaj, Kumar Pranjal
    Abstract:

    A rootkit is a collection of tools that is designed to gain administrator-level access over a computer system while hiding itself from the user and the operating system, by compromising the communication channels within the operating system. A well-designed rootkit can hide files, data, processes, and network ports, and can typically survive a system restart. The effect of this stealthy design allows the rootkit to perform malicious activities such as keystroke logging or give a remote attacker control of the infected system. Even though current rootkits are extremely stealthy, there still exist a number of techniques that have been developed to detect their presence. These techniques include signature-based detection, heuristic or behavior based detection, Host Integrity Monitoring, and network-based detection. This thesis will compare the operation of different types of detection methods against several of the most common rootkits that are currently affecting Windows-based systems.