Cyber Threat Intelligence: Analysis of adversaries and their methods

The growing dependency on interconnected devices makes cyber crime increasingly lucrative. Together with the rise of premade tools to perform exploits, the number of cyber incidents grows rapidly each year. Defending against these threats becomes increasingly difficult as organizations depend heavily on the Internet and have many different...

Scan, Test, Execute: Adversarial Tactics in Amplification DDoS Attacks

Amplification attacks generate an enormous flood of unwanted traffic towards a victim and are generated with the help of open, unsecured services, to which an adversary sends spoofed service requests that trigger large answer volumes to a victim. However, the actual execution of the packet flood is only one of the activities necessary for a...

Fingerprinting tooling used for SSH compromisation attempts

In SSH brute forcing attacks, adversaries try a lot of different username and password combinations in order to compromise a system. As such activities are easily recognizable in log files, sophisticated adversaries distribute brute forcing attacks over a large number of origins. Effectively finding such distributed campaigns proves however...

Scanners: Discovery of distributed slow scanners in telescope data

The internet is rapidly growing, and with it grows the number of malicious actors. For many attacks, the attacker first scans the internet to detect vulnerable devices. In order to evade detection, the attacker distributes the scanning over a large number of machines. Because attackers are distributing this scanning and there is no way to find...

Multi-agent systems in StarCraft

The Interactive Intelligence section of the TU Delft would like to replace the game UT3 that is used in the Multi-Agent Systems project (MAS-project), which is a part of the bachelor curriculum of computer science. The game that has been selected for this purpose is StarCraft. StarCraft is called the `next challenge in AI development' by Google....