IPv6 in any given day

This is a previous result of some research that I am doing in IPv6 usage.

From the access in IPv6 received by lacnic.net (just www) this is the distribution of OSs and browsers in a random day that I selected on September:

{'Googlebot': 170, 'Windows': 2878, 'Unknown': 772, 'Linux': 3933, 'Macintosh': 2214}
{'Konqueror': 99, 'Firefox': 5732, 'Microsoft Internet Explorer': 1174, 'Chrome': 844, 'Opera': 383, 'Safari': 729}

Errata: It's not a day, it's a week

Need a botnet, only $9.00 the hour

Adding a bit of salt to the problem of botnets and the topic about "Attack as a Service (AaaS)" (not sure if the term really exists) this note is intersting:

Study finds the average price for renting a botnet

http://www.zdnet.com/blog/security/study-finds-the-average-price-for-renting-a-botnet/6528

"Based on an experiment conducted by researchers from VeriSign’s iDefense Intelligence Operations Team, involving 25 different "rent a botnet" underground marketplace propositions, they were able to conclude that the average price for renting a botnet is $67 for 24 hours, and $9 for hourly access."

Some other articles about bontnets:

The attack of the opt-in botnets

http://www.zdnet.com/blog/security/attack-of-the-opt-in-botnets/6268

The biggest cloud on the planet is owned by ... the crooks

http://www.networkworld.com/community/node/58829

The Cloud of real time for London 2012

I just read about an article about a "Cloud of real time information for London 2010". I wrote a bit in my blog in Spanish, there is an automatic translation here.

I won't write too much about it, I would prefer to you to go to the Cloud website or to the original article from TechCrunch or in . However, I would say that the project seems quite a challenge and I am looking forward to hearing more about it in the near future.

DoS/DDoS news resources

Considering the hype about DoS and DDoS in the last days as consequence of attacks to Twitter, Facebook and LiveJournal I decided to include some of my information sources in this blog. I did some redesign of the right bar. I included some DoS and DDoS news, they are a set of news manually selected by me. I take the news from different sources and I apply some basic filtering and data-mining I come with them. They can be also accessed here if you want to include them in your RSS reader.

"Security news from Twitter" are posts about DoS/DDoS attacks collected from twitter. This is a little bit noisy with around 30-50 posts per day. Some of the posts are repeated or uninterested (from my perspective) but it works as a source for my tools that extract some information for them. The raw feeds are here and here.

Finally I included some general IT security news from twittsecurity. Twittsecurity is a bot that shares security news in Twitter. It searches and selects IT security news using a hybrid method (automatic and human assisted). Feel free to follow it.

Some Machine Learning Libraries

I've been doing some experiments using "machine learning" on several projects and I would like to talk a bit about them. For now all I am coding in Python, but also I'll comment on some Java and C++ libraries.

A simple to use is FANN (Fast Artificial Neural Network). It also has ports for Python and other languages (PHP, Java, Perl, etc.. Although the Python version of Python did not work for me for some reason).

For Support Vector Machines I used LIBSVM (A Library for Support Vector Machines). In the website you can even find a number of recommendations for using SVMs. Other libraries supporting SVM are PyML and MLPy (but for some reason the compilation did not work on my machine, so I used LIBSVM).

A very interesting library implementing a Naive Bayes Classifier is Orange. I have not tested but it looks good, plus, it has good documentation and links to various datasets.

If you are interested in Reinforcement Learning, Tiles is a library in Python (also in C + + and Lisp) that allows you to "transform" the inputs to a value function represented by an array of tiles. In general, to represent a state in high resolution tiles are better than just simple states.

If you want a "decision tree" you can use this that is included and explained in the book "Collective Intelligence". I think that the algorithm used is based on ID3.

And finally, mahout. This is an Apache Foundation project. For now is out of my reach to test it. I do not have the infrastructure or the need to use it. It is based on Hadoop and mapreduce concepts. Very interesting.


PS: If you want more resources about machine learning, these are my delicious bookmarks on the topic.

Some NS-2 code to simulate DoS and DDoS attacks

This is some basic TCL code that used for some simulations. This code works on the NS-2 network simulator.

Simple simulation with flow monitors. It creates 4 nodes: 1 UDP source and 1 TCP source (FTP), 1 destination node and 1 transit node. It monitors the flows coming in and out from the queue in the link between the transit and destination node. It dumps the trace data to a flow file.

Ping Flood . It creates two nodes. Node 1 floods ping packets to Node 2. It could be useful to simulate Denial of Service attacks.

Simple DoS Attack. It creates a topology of 7 nodes. Two nodes generate valid traffic (one UDP and another TCP in the form of FTP). Another node generates and UDP DoS.

SPAM and the commerce of fear

A few days ago I commented that the spammers would soon begin sending mails about medication against the swine flu and replacing the old viagra SPAM. Shortly after, the US-CERT warned of phishing attacks using this new vector for social engineering and the SANS published a list of sites that could generate malware/phishing /scams (according to the particular domain names selected).

Well today I received my first flu-related SPAM. Also, visiting a news site I found this ad from Google Ads. The ads are not malware sites (at least these three do not appear to be, but try them at your own risk), but certainly they plan to profit from the people's fear.



Well, I think that we humans are quite predictable.