---

Co-located with the MAAWG 26th general meeting
Date: October 22 (Mon), 2012
Place: Hilton Hotel, Baltimore, MD

Announcement

The ISC/CAIDA Data Collaboration workshop is a venue for:

1. Showcasing novel case studies of network and security data analysis and data sharing
2. Discussing data synthesis techniques and technologies
3. In-person networking between data providers and recipients in research and operations
4. SIE data contributors to hear and discuss how their shared data is providing value
5. Learning how open-source SIE technology can be incorporated into collaborative research data collection and sharing efforts

Topics to be discussed include:

• Introduction to SIE and NMSG (Concepts, Toolkit, Methods, and Design needed to create your own security data redistribution network)
• Demos and tutorials on how to implement Passive DNS Replication sensor, darknet sensors, spam sensors
• Case studies of SIE data and DNSDB usage (research and operational)

Registration

Attendees will be asked to submit brief, informal abstracts for presentations, or expressions of interest in moderating a discussion topic or breakout roundtable. Each attendee is expected to actively participate as well as provide input, writing, and/or feedback on the report we'll publish within 6 weeks after the workshop.

Registration for the ISC-CAIDA workshop is closed.

---

Workshop Agenda

October 22 (Monday)

Place: Hilton Hotel, Baltimore, MD

• 09:00 - 9:15 Introductions
  • Merike Kaeo (Double Shot Security), Introductions (15 min)
• 9:15 - 9:45
  • Eric Ziegast (ISC), Build your own SIE (30 min)
• 10:00 - 10:15
  • David Dagon (Georgia Institute of Technology), Teaching NMSG - lessons learned from a tutorial (15 min)
• 10:15 - 10:45
  • Paul Vixie (ISC), Implications of SIE (30 min)
• 10:45 - 11:00 break
• 11:00 - 12:00
  • Robert Edmonds (ISC), Sorted String Tables: ISC mtbl and ISC dnstable (60 min)
• 12:00 - 13:30 working lunch
• 13:30 - 15:20 DNS I
  • Damon McCoy (George Mason University), Manufacturing Compromise: The Emergence of Exploit-as-a-Service (25 min)
  • Roberto Perdisci (University of Georgia), FluxBuster (20 min)
  • Casey Deccio (Sandia National Laboratories), Qualitative DNS Measurement Perspectives (20 min)

  14:35 - 14:50 break

  • John Heidemann (USC/Information Sciences Institute), Broadening DNS Research (20 min)
• 15:10 - 16:00 Network Analysis
  • Ed Stoner (CERT/CC), Network Threat Detection and Event Correlation (25 min)
  • David Plonka (University of Wisconsin-Madison), Rendezvous-based analysis, measurement and threat detection (25 min)
• 16:00 - 16:45 DNS II
  • David Dagon (Georgia Institute of Technology), DNS Path Measurement (20 min)
  • John-Paul Verkamp (University of Indiana), Rebuilding zone files from passive DNS data (20 min)
• 16:45 - 17:30 Security Data Flea Market
  • Discussion (45 min)
• 17:30 Adjourn