Notice Correlation and Covert CTC Detection — Michael Dopheide & Ross Gegan
Channel: Zeek
Date: 2016-11-10

This first part of this talk examines the possibilities available when correlating multiple Bro notices together both to make more informed, yet still automatic decisions. The second part of the talk switches gears completely. Many organizations have implemented traffic shunting to offload large flows that are generally considered to be uninteresting to Bro. However, large file transfers are a perfect place for exfiltration of data via covert timing channels (CTC). This summer we’ve taken research into known CTC detection methods and implemented them in Bro. We’ll share the results of this work.

Michael “Dop” Dopheide is a senior security enginner for ESnet. Ross Gegan is a graduate student at University of California at Davis.

Slides: https://www.bro.org/brocon2016/slides/dopheide_gegan_notice.pdf