RE: profiling honeypots..

[Nigel Clarke <nigel () 26354 net>]

On Mon, 2003-04-07 at 13:46, Toby Miller wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I have been reading this thread with great interest and the dialogue
> is good but the one thing people need to realize is that profiling is
> an art not a science.

Toby, I am interested in learning what would classify profiling as an
art and not a science? 


> I have given some lectures on my model and the
> one thing people fail to realize is that no model will be accurate
> 100% of the time. The FBI will tell you their profiling system is not
> accurate 100% of the time. What we need to do is come up with a model
> that can is accurate most of the time and can be used as a another
> tool in the honeypot/ids world.

It is important to develop a model. One thing that prohibits development
are some of the networks and the way they are designed. If client X is
attacked, depending on the severity of the outage you won't have the
chance to perform and type of analysis. Not everyone uses TCP dump
recorders. 
>
-- 
Nigel Clarke
Blade Runner #26354
*Filed and Monitored*