The Bro ICAP Analyzer by Mark Fernandez
Channel: Zeek
Date: 2016-12-22

This presentation describes the Internet Content Adaptation Protocol (ICAP) analyzer for the Bro Network Security Monitor tool as a novel means by which to inspect Hyper-Text Transfer Protocol Secure (HTTPS) traffic in plain-text. It contains an overview of the ICAP specification, an overview of the Bro ICAP analyzer and how it interfaces with the HTTP analyzer and other Bro analyzers.

Approved for public release. Distribution unlimited. Case number 16-2621. © 2016 The MITRE Corporation. All rights reserved.

Speaker Bio: Mark Fernandez is a cybersecurity engineer at MITRE Corporation. His first interaction with Bro was last autumn to develop a new protocol analyzer via BinPAC.

Slides: https://www.bro.org/brocon2016/slides/fernandez_icap.pdf