222 lines
7.7 KiB
HTML
222 lines
7.7 KiB
HTML
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||
|
|
<head>
|
||
|
|
<meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
|
||
|
|
<meta content="Pentabarf" name="generator"/>
|
||
|
|
<meta content="2011-04-24" name="DC.date"/>
|
||
|
|
<title>EH2011: X-ARF: Network Abuse Reporting 2.0</title>
|
||
|
|
<link type="text/css" href="../../style.css" rel="Stylesheet" media="screen,print"/>
|
||
|
|
</head>
|
||
|
|
<body>
|
||
|
|
<div class="noprint" id="conference-logo">
|
||
|
|
<a href="http://easterhegg2011.hamburg.ccc.de">
|
||
|
|
<img alt="Easterhegg 2011" src="../../images/conference-128x128.png"/>
|
||
|
|
</a>
|
||
|
|
</div>
|
||
|
|
<div class="noprint" id="menu">
|
||
|
|
<ul>
|
||
|
|
<li>
|
||
|
|
<a href="../../index.en.html">
|
||
|
|
<span class="normal">Index</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<a href="../../day_2011-04-22.en.html">
|
||
|
|
<span class="normal">Karfreitag - 2011-04-22</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<a href="../../day_2011-04-23.en.html">
|
||
|
|
<span class="normal">Ostersamstag - 2011-04-23</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<a href="../../day_2011-04-24.en.html">
|
||
|
|
<span class="normal">Ostersonntag - 2011-04-24</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<a href="../../day_2011-04-25.en.html">
|
||
|
|
<span class="normal">Ostermontag - 2011-04-25</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<a href="../../speakers.en.html">
|
||
|
|
<span class="normal">Speakers</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<a href="../../events.en.html">
|
||
|
|
<span class="normal">Events</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<ul class="track">
|
||
|
|
<li class="track-hacking">
|
||
|
|
<a href="../../track/Hacking/index.en.html">
|
||
|
|
<span class="normal">Hacking</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li class="track-administration">
|
||
|
|
<a href="../../track/Administration/index.en.html">
|
||
|
|
<span class="normal">Administration</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li class="track-gesellschaft">
|
||
|
|
<a href="../../track/Gesellschaft/index.en.html">
|
||
|
|
<span class="normal">Gesellschaft</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li class="track-making">
|
||
|
|
<a href="../../track/Making/index.en.html">
|
||
|
|
<span class="normal">Making</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li class="track-historylessons">
|
||
|
|
<a href="../../track/history lessons/index.en.html">
|
||
|
|
<span class="normal">history lessons</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
<li class="track-meta">
|
||
|
|
<a href="../../track/Meta/index.en.html">
|
||
|
|
<span class="normal">Meta</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
<div id="content">
|
||
|
|
<p class="release">EH2011 - 21</p>
|
||
|
|
<p class="intro">
|
||
|
|
<strong>Easterhegg 2011</strong>
|
||
|
|
<br/>
|
||
|
|
<em>the ccc family event</em>
|
||
|
|
</p>
|
||
|
|
<div class="section vevent" id="event">
|
||
|
|
<div id="infobox">
|
||
|
|
<table>
|
||
|
|
<tr>
|
||
|
|
<th colspan="2">Speakers</th>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td>
|
||
|
|
<a href="../../speakers/3263.en.html">
|
||
|
|
<img height="32" width="32" src="../../images/person-0-32x32.png"/>
|
||
|
|
</a>
|
||
|
|
</td>
|
||
|
|
<td>
|
||
|
|
<a href="../../speakers/3263.en.html">Matthias Bräck</a>
|
||
|
|
</td>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td>
|
||
|
|
<a href="../../speakers/3102.en.html">
|
||
|
|
<img height="32" width="32" src="../../images/person-3102-32x32.png"/>
|
||
|
|
</a>
|
||
|
|
</td>
|
||
|
|
<td>
|
||
|
|
<a href="../../speakers/3102.en.html">Sven Übelacker</a>
|
||
|
|
</td>
|
||
|
|
</tr>
|
||
|
|
</table>
|
||
|
|
<table>
|
||
|
|
<tr>
|
||
|
|
<th colspan="2">Schedule</th>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td class="keyword">Day</td>
|
||
|
|
<td class="value">Ostersamstag - 2011-04-23</td>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td class="keyword">Room</td>
|
||
|
|
<td class="value location">Aula</td>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td class="keyword">Start time</td>
|
||
|
|
<td class="value dtstart" title="2011-04-24T12:00:00+02:00">12:00</td>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td class="keyword">Duration</td>
|
||
|
|
<td class="value duration" title="P01H30M00S">01:30</td>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<th colspan="2">Info</th>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td class="keyword">ID</td>
|
||
|
|
<td class="value" title="4293@EH2011@pentabarf.org">4293</td>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td class="keyword">Event type</td>
|
||
|
|
<td class="value">Lecture</td>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td class="keyword">Track</td>
|
||
|
|
<td class="value">Administration</td>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td class="keyword">Language used for presentation</td>
|
||
|
|
<td class="value">German</td>
|
||
|
|
</tr>
|
||
|
|
</table>
|
||
|
|
<table>
|
||
|
|
<tr>
|
||
|
|
<th colspan="2">Feedback</th>
|
||
|
|
</tr>
|
||
|
|
<tr>
|
||
|
|
<td class="feedback" colspan="2">
|
||
|
|
Did you attend this event? <br/>
|
||
|
|
<a href="https://cccv.pentabarf.org/feedback/EH2011/event/4293.en.html">Give Feedback</a>
|
||
|
|
</td>
|
||
|
|
</tr>
|
||
|
|
</table>
|
||
|
|
</div>
|
||
|
|
<h1 class="title summary">X-ARF: Network Abuse Reporting 2.0</h1>
|
||
|
|
<p class="subtitle"></p>
|
||
|
|
<img class="event-image" src="../../images/event-4293-128x128.png"/>
|
||
|
|
<div class="abstract">
|
||
|
|
<p>X-ARF (eXtensible Abuse Report Format) ist ein standardisiertes Format, um Sicherheitsvorfälle per E-Mail zu melden. X-ARF lässt sich für verschiedene
|
||
|
|
Anwendungszwecke (z.B. Meldung von Account Probes, Malware Attacks, Phishing) über definierte Schemata einsetzen, was eine hohe Flexibilität hinsichtlich neuer Vorfallskategorien darstellt. Die Lesbarkeit für Menschen und Maschinen ist ein großer Vorteil für die Verarbeitung von Vorfallsmeldungen in diesem Format und stellt eine der zentralen Ideen bei X-ARF dar.</p> </div>
|
||
|
|
<div class="description">
|
||
|
|
<p>Das Melden von Sicherheitsvorfällen (Abuse Reporting) hilft dabei, dass IT-Verantwortliche für Netzbereiche, aus denen Angriffe erfolgen oder in denen
|
||
|
|
Malware bereitgestellt wird, darüber in Kenntnis gesetzt werden können. Da CSIRTs Abuse Handling für meist große Netzbereiche betreiben, ist hier ein einheitliches Format, welches automatisiert verarbeitet werden kann, von sehr großem Vorteil. Zwar existieren bereits einige Formate wie z.B. ARF,
|
||
|
|
IDMEF und IODEF, die sich diesem Problem teilweise annehmen, jedoch weisen diese Probleme bezüglich ihrer Flexibilität, Einsatzgebietes und Komplexität
|
||
|
|
auf. Bisher fehlte ein einfaches, menschenlesbares Format für Vorfallsmeldungen, welches automatisch und auch manuell verarbeitet und validiert werden kann.</p>
|
||
|
|
|
||
|
|
<p>Im Vortrag werden der aktuelle Entwicklungsstand und mögliche Einsatzgebiete von X-ARF vorgestellt, auch unter dem Blickwinkel des Administrators, der Angriffe auf seine Server oder Infrastruktur melden möchte.</p> </div>
|
||
|
|
<div class="links">
|
||
|
|
<h2>Links</h2>
|
||
|
|
<ul>
|
||
|
|
<li>
|
||
|
|
<a href="http://www.x-arf.org/" rel="bookmark">X-ARF Homepage</a>
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<a href="ftp://ftp.dfn-cert.de/pub/tools/x-arf/" rel="bookmark">X-ARF SSH Probe Reporter</a>
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<a href="http://www.flickr.com/photos/phineasx/130105276/" rel="bookmark">Event Image from PhineasX, CC by-nc-nd 2.0</a>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
<div id="navigation">
|
||
|
|
<a href="../../track/Administration/4272.en.html">
|
||
|
|
<span class="previous" title="Up and down the tcpip protocol stack"><<<</span>
|
||
|
|
</a>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<div class="noprint" id="conference-logo">
|
||
|
|
<a href="http://easterhegg2011.hamburg.ccc.de/index.shtml">
|
||
|
|
<img src="'http://easterhegg2011.hamburg.ccc.de/img/eh2011_banner_final_o_LOGO.png" alt="Easterhegg 2011" width="1280" height="160"/>
|
||
|
|
</a>
|
||
|
|
</div>
|
||
|
|
<li>
|
||
|
|
<a href="http://easterhegg2011.hamburg.ccc.de/index.shtml">
|
||
|
|
<span class="normal">Home</span>
|
||
|
|
</a>
|
||
|
|
</li>
|
||
|
|
</body>
|
||
|
|
</html>
|