From: Mulyadi Santosa <a_mulyadi@softhome.net>
To: qemu-devel@nongnu.org, Herbert Bos <herbertb@cs.vu.nl>
Subject: Re: [Qemu-devel] Argos: qemu-based honeypot
Date: Wed, 21 Dec 2005 17:28:55 +0700 [thread overview]
Message-ID: <200512211728.55521.a_mulyadi@softhome.net> (raw)
In-Reply-To: <43A86DF6.4080005@cs.vu.nl>
Dear Dr Bos..
First, congratulations for the Argos release. Looks interesting for
me..I'll give it a try ASAP.
> We have extended QEMU to enable it to detect remote attempts to
> compromise the emulated guest operating system. Using dynamic taint
> analysis Argos tracks network data throughout the processor's
> execution and detects any attempts to use them in a malicious way.
> When an attack is detected the memory footprint of the attack is
> logged and the emulators exits.
Pardon me, can you explain what dynamic taint means? Is it somekind of
code instrumentation similar with Bochs? If yes, I'd love to study on
how you do it since I am planning to do something like that since long
time ago but still unable to dig deeper about Qemu internals...
regards
Mulyadi
next prev parent reply other threads:[~2005-12-21 12:53 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-12-20 20:47 [Qemu-devel] Argos: qemu-based honeypot Herbert Bos
2005-12-21 10:28 ` Mulyadi Santosa [this message]
2005-12-22 0:19 ` Tace
-- strict thread matches above, loose matches on Subject: below --
2005-12-23 21:03 Herbert Bos
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200512211728.55521.a_mulyadi@softhome.net \
--to=a_mulyadi@softhome.net \
--cc=herbertb@cs.vu.nl \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).