Category: data driven security
Everything filed under data driven security.
Your Logs Contain a Plea for Assistance In a Packet Bottle and You Likely Never Noticed It
PCAP forensics of the HMEFB worm: a self-propagating scanner with a Belarusian engineer's escape plea embedded in HTTP requests.
[un]prompted Spring 2026: Threat Hunting In The Matrix
At our previous employer, the global deception and detection infrastructure generates tons of events that eventually make their way into an ever-growing data lake with (as of February 2026) 22 TB of PCAPs and 32 TB of session protocol…
Acoustic: Solving a CyberDefenders PCAP SIP/RTP Challenge with R, Zeek, tshark (& friends)
Hot on the heels of the previous CyberDefenders Challenge Solution comes this noisy installment which solves their Acoustic…
Packet Maze: Solving a CyberDefenders PCAP Puzzle with R, Zeek, and tshark
It was a rainy weekend in southern Maine and I really didn't feel like doing chores, so I was skimming through RSS feeds and noticed a link to a PacketMaze challenge in the latest This Week In 4n6…
CRAN Mirror "Security"
In the "Changes on CRAN" section of the latest version of the The R Journal (Vol. 10/2, December 2018) had this short blurb entitled "CRAN mirror…
2018 IEEE Security & Privacy (Filtered) Paper Dump
The 2018 IEEE Security & Privacy Conference is in May but they've posted their full proceedings and it's better to grab them early than to wait for it to become part of a paid journal…
New viridis & colorbrewer palettes for ipv4-heatmap
It's no seekrit that I :heart: Hilbert curve heatmaps of IPv4 space. Real-world IPv4 maps (i.e. the ones that drop dots on the Earth) have little utility, but with Hilbert curves maps of IPv4 space many different topologies can be…
Visualizing Survey Data : Comparison Between Observations
Cybersecurity is a domain that really likes surveys, or at the very least it has many folks within it that like to conduct and report on surveys. One recent survey on threat intelligence is in it's second year, so it sets about comparing…
Spending Seized Assets - A State-by-State Per-capita Comparison in R
The Washingon Post did another great story+vis, this time on states Spending seized…
Using Twitter as a Data Source For Monitoring Password Dumps
I shot a quick post over at the Data Driven Security blog explaining how to separate Twitter data gathering from R code via the Ruby t (github repo) command. Using t frees R code from having to be a Twitter processor and lets the analyst…