PANDAcap: A framework for streamlining collection of full-system traces

Manolis Stamatogiannakis; Herbert Bos; Paul Groth

doi:10.1145/3380786.3391396

PANDAcap: A framework for streamlining collection of full-system traces

Manolis Stamatogiannakis
, Herbert Bos
, Paul Groth

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

284 Downloads (Pure)

Abstract

Full-system, deterministic record and replay has proven to be an invaluable tool for reverse engineering and systems analysis. However, acquiring a full-system recording typically involves signifcant planning and manual effort. This represents a distraction from the actual goal of recording a trace, i.e. analyzing it. We present PANDAcap, a framework based on PANDA full-system record and replay tool. PANDAcap combines off-the-shelf and custom-built components in order to streamline the process of recording PANDA traces. More importantly, in addition to making the setup of one-off experiments easier, PANDAcap also caters to the streamlining of systematic repeatable experiments in order to create PANDA trace datasets. As a demonstration, we have used PANDAcap to deploy an ssh honeypot aiming to study the actions of brute-force ssh attacks.

Original language	English
Title of host publication	EuroSec '20
Subtitle of host publication	Proceedings of the 13th European Workshop on Systems Security
Publisher	Association for Computing Machinery, Inc
Pages	1-6
Number of pages	6
ISBN (Electronic)	9781450375238
DOIs	https://doi.org/10.1145/3380786.3391396
Publication status	Published - 2020
Event	13th European Workshop on Systems Security, EuroSec 2020 - Heraklion, Greece Duration: 27 Apr 2020 → …

Conference

Conference	13th European Workshop on Systems Security, EuroSec 2020
Country/Territory	Greece
City	Heraklion
Period	27/04/20 → …

Keywords

Dataset
Docker
Framework
Honeypot
PANDA
Record and replay

Access to Document

10.1145/3380786.3391396

PANDAcap_A framework for streamlining collection of fullsystem tracesFinal published version, 179 KBLicence: Article 25fa Dutch Copyright Act

Persistent URL (handle)

Persistent link

Cite this

@inproceedings{0b6aa4c101da4cb597aaaa90e97c5ed9,

title = "PANDAcap: A framework for streamlining collection of full-system traces",

abstract = "Full-system, deterministic record and replay has proven to be an invaluable tool for reverse engineering and systems analysis. However, acquiring a full-system recording typically involves signifcant planning and manual effort. This represents a distraction from the actual goal of recording a trace, i.e. analyzing it. We present PANDAcap, a framework based on PANDA full-system record and replay tool. PANDAcap combines off-the-shelf and custom-built components in order to streamline the process of recording PANDA traces. More importantly, in addition to making the setup of one-off experiments easier, PANDAcap also caters to the streamlining of systematic repeatable experiments in order to create PANDA trace datasets. As a demonstration, we have used PANDAcap to deploy an ssh honeypot aiming to study the actions of brute-force ssh attacks.",

keywords = "Dataset, Docker, Framework, Honeypot, PANDA, Record and replay",

author = "Manolis Stamatogiannakis and Herbert Bos and Paul Groth",

year = "2020",

doi = "10.1145/3380786.3391396",

language = "English",

pages = "1--6",

booktitle = "EuroSec '20",

publisher = "Association for Computing Machinery, Inc",

note = "13th European Workshop on Systems Security, EuroSec 2020 ; Conference date: 27-04-2020",

}

Stamatogiannakis, M, Bos, H & Groth, P 2020, PANDAcap: A framework for streamlining collection of full-system traces. in EuroSec '20: Proceedings of the 13th European Workshop on Systems Security. Association for Computing Machinery, Inc, pp. 1-6, 13th European Workshop on Systems Security, EuroSec 2020, Heraklion, Greece, 27/04/20. https://doi.org/10.1145/3380786.3391396

PANDAcap: A framework for streamlining collection of full-system traces. / Stamatogiannakis, Manolis; Bos, Herbert; Groth, Paul.
EuroSec '20: Proceedings of the 13th European Workshop on Systems Security. Association for Computing Machinery, Inc, 2020. p. 1-6.

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - PANDAcap: A framework for streamlining collection of full-system traces

AU - Stamatogiannakis, Manolis

AU - Bos, Herbert

AU - Groth, Paul

PY - 2020

Y1 - 2020

N2 - Full-system, deterministic record and replay has proven to be an invaluable tool for reverse engineering and systems analysis. However, acquiring a full-system recording typically involves signifcant planning and manual effort. This represents a distraction from the actual goal of recording a trace, i.e. analyzing it. We present PANDAcap, a framework based on PANDA full-system record and replay tool. PANDAcap combines off-the-shelf and custom-built components in order to streamline the process of recording PANDA traces. More importantly, in addition to making the setup of one-off experiments easier, PANDAcap also caters to the streamlining of systematic repeatable experiments in order to create PANDA trace datasets. As a demonstration, we have used PANDAcap to deploy an ssh honeypot aiming to study the actions of brute-force ssh attacks.

AB - Full-system, deterministic record and replay has proven to be an invaluable tool for reverse engineering and systems analysis. However, acquiring a full-system recording typically involves signifcant planning and manual effort. This represents a distraction from the actual goal of recording a trace, i.e. analyzing it. We present PANDAcap, a framework based on PANDA full-system record and replay tool. PANDAcap combines off-the-shelf and custom-built components in order to streamline the process of recording PANDA traces. More importantly, in addition to making the setup of one-off experiments easier, PANDAcap also caters to the streamlining of systematic repeatable experiments in order to create PANDA trace datasets. As a demonstration, we have used PANDAcap to deploy an ssh honeypot aiming to study the actions of brute-force ssh attacks.

KW - Dataset

KW - Docker

KW - Framework

KW - Honeypot

KW - PANDA

KW - Record and replay

UR - https://www.scopus.com/pages/publications/85088301724

UR - https://www.scopus.com/pages/publications/85088301724#tab=citedBy

U2 - 10.1145/3380786.3391396

DO - 10.1145/3380786.3391396

M3 - Conference contribution

AN - SCOPUS:85088301724

SP - 1

EP - 6

BT - EuroSec '20

PB - Association for Computing Machinery, Inc

T2 - 13th European Workshop on Systems Security, EuroSec 2020

Y2 - 27 April 2020

ER -

PANDAcap: A framework for streamlining collection of full-system traces

Abstract

Conference

Keywords

Access to Document

Persistent URL (handle)

Other files and links

Fingerprint

PANDAcap SSH Honeypot Dataset

PANDAcap SSH Honeypot Dataset

PANDAcap SSH Honeypot Dataset

Cite this

PANDAcap: A framework for streamlining collection of full-system traces

Abstract

Conference

Keywords

Access to Document

Persistent URL (handle)

Other files and links

Fingerprint

Datasets

PANDAcap SSH Honeypot Dataset

PANDAcap SSH Honeypot Dataset

PANDAcap SSH Honeypot Dataset

Cite this