1. The National Plateforme for Tracking Cyber Attacks :
« SAHER »
By Hafidh EL Faleh
NACS

2. Perimeter of the project
The NACS is member of :

3. Make a dashbord ( Alert Level) of National Cyberspace.
SAHER Objectifs
Make a dashbord ( Alert Level) of National Cyberspace.
Take a platforme support for incident handling, investigation and legal forensics.
Devellopement of solutions for traking cyber attacks with DIDS, Honeypots and deploying many sensors.
Monotoring criticals infrastrcture and detect anomalies into her systems.

4. Supervise Web sites to detects defacements attacks.
SAHER Objectifs
Supervise Web sites to detects defacements attacks.
Maintain a system for malware detection (virus, botnets, torjans) , and use cordination to cleanup the National Cyberspace.
Build an information database for types of attack, leaks of vulnerability and blackliste.

5. SAHER est une plateforme à trois couches
Couche WORKFLOW
Couche analyse et corrélation
Couche de collecte et de détection

6. CEWS Architecture

7. Détection
SAHER-WEB: ce sont des routines qui ont pour bute de vérifier l’intégrité des sites Web.
SAHER-SRV: ce sont des routines qui ont pour bute de vérifier la disponibilité des serveurs Web, MAIL et DNS
Les IDS: des Snorts qui sont généralement installés dans les espaces d’hébergement WEB.
Les honeynets: plusieurs solutions de déférentes types sont disponibles dans le monde du logiciels libres. 7

8. Collecte
We need to exchange security events and collaboration to handle incidents:
Incidents:
Phishing
Web defacement
Scan
Intrusion
Spam / Scam
DoS / DDoS
Malware:
Worm spread
Botnet / C&C
HoneyNet detection
Vulnerabilities
Exploit
Zero days
Product vulnerability

9. ISAC: Information Sharing and Analysis Center

10. Workflow interne
A CSIRT is a team that responds to computer security incidents by providing all necessary services to solve the problem(s) or to support the resolution of them

11. Workflow: Plateforme de coordination
USER
USER
USER
Sensors
TEL
SMTP Server S1
Central DB
Autres CERT
tunCERT
Incident
pentest
Watch
Veille S2
TEL
mail
mail S3
SNORT
Tel, mail
ISP
IDS DB

13. Saher-Web: Detection

14. Saher-IDS: Statistiques

15. Saher-Honeynet: Architecture et Outils
2500 Public IP
From the starting of the project, the team tried to be up-to-date in term of used technologies; they tested all detection and honyepotting tools and tried to choose the most reliable ones.

16. Annually evolution of attacks
Saher-Honeynet
Annually evolution of attacks

17. Saher-Honeynet Website: Online statistics

18. Saher-Honeynet Website: « Dashboard »

19. Ideas For Projects IP Reputation Dadabase
Designing and specifying a tool to interface with a lot of honeypot tools (dionaea, glastopf, kippo ..) and provide an update database to cheeck a reputation of any IP address related with her historic logs.
Provide an web access (web services) to this tool , automatic getting Ip source and providing information related her reputation historic and sending necessary instructions for cleanning process.

20. Designing and specifying techniques for black-list tool.
Ideas For GSoc 2012
Black-List Generator
Create an updated list for malicious domains and hosts from malwares offred.
Select Profile of equipments to generate ACL (Firewall, IDS/IPS, Proxy ..) .
Designing and specifying techniques for black-list tool.
Online sharing of black-list.

21. Save passive DNS Detection
ISP 2
ISP 1
ISP 3
IDS
IDS
IDS 2
Update D-IDS Rules 3
Save passive DNS Detection 1
Extract List of
Malicious Domains
Watch for logs

22. THANKS http://www.honeynet.tn honeynet@ansi.tn Hafidh.faleh@gmail.com