Christian Rossow's blog http://www.christian-rossow.de Tue, 03 Apr 2012 00:00:00 +0000 Tue, 03 Apr 2012 00:00:00 +0000 christian.rossow@removethis-gmail.com (Christian Rossow) I am happy to announce that our paper 'Prudent Practices for Designing Malware Experiments: Status Quo and Outlook' was accepted as a Systematization of Knowledge Paper at the IEEE Symposium on Security and Privacy (S&P) 2012. http://www.christian-rossow.de/articles/Prudent_Practices_for_Designing_Malware_Experiments_Status_Quo_and_Outlook.php http://www.christian-rossow.de/articles/Prudent_Practices_for_Designing_Malware_Experiments_Status_Quo_and_Outlook.php Sat, 03 Mar 2012 13:37:33 +0000 Our paper dealing with DNS as carrier for botnet command and control channels got accepted at this year's EC2ND conference. http://www.christian-rossow.de/articles/Botnets_Using_DNS_based_Command_and_Control_Channels.php http://www.christian-rossow.de/articles/Botnets_Using_DNS_based_Command_and_Control_Channels.php Tue, 23 Aug 2011 13:37:33 +0000 As explained in this article, the byte entropy of a string is a good indicator for randomness in data. This, in turn, may indicate that the data is either compressed or encrypted. However, the maximum byte entropy is lower for alphabets with a smaller size, such as base64 encoded data. I have extended pg_randomness such that you are able to determine the maximum byte entropy given any alphabet size. http://www.christian-rossow.de/articles/PostgreSQL_pg-randomness_And_Expected_Random_Byte_Entropy.php http://www.christian-rossow.de/articles/PostgreSQL_pg-randomness_And_Expected_Random_Byte_Entropy.php Wed, 11 May 2011 13:37:33 +0000 As part of my PhD and in collaboration with colleages from if(is), I developed a system called Sandnet to analyze the network traffic of malicious software. Last week I presented Sandnet at the ACM BADGERS Workshop in Salzburg, Vienna. http://www.christian-rossow.de/articles/Sandnet_Network_Traffic_Analysis_of_Malicious_Software.php http://www.christian-rossow.de/articles/Sandnet_Network_Traffic_Analysis_of_Malicious_Software.php Mon, 18 Apr 2011 13:37:33 +0000 CDF graphs are a cool way to describe a probability distribution. However, since neither creating a CDF with gnuplot is easy, nor the data format gnuplot requires is intuitively clear, I will explain how to create a CDF with gnuplot in conjunction with SQL in this article. http://www.christian-rossow.de/articles/Cumulative_Distribution_Function_CDF_With_Gnuplot_And_PostgreSQL.php http://www.christian-rossow.de/articles/Cumulative_Distribution_Function_CDF_With_Gnuplot_And_PostgreSQL.php Mon, 14 Feb 2011 13:37:33 +0000 Since ever I was looking for psql aggregate functions that calculate the median, 1st and 3rd quartiles of data. For other people having the same issue: this can be done using PL/Python. http://www.christian-rossow.de/articles/PostgreSQL_boxplot_median_quartiles_aggregate_function.php http://www.christian-rossow.de/articles/PostgreSQL_boxplot_median_quartiles_aggregate_function.php Thu, 18 Mar 2010 13:37:33 +0000 The pg-randomness project was released on pgFoundry that add the support of statistical calculation functions (entropy, chi-square) to PostgreSQL. http://www.christian-rossow.de/articles/PostgreSQL_pg-randomness_Shannon_entropy_and_chi_square.php http://www.christian-rossow.de/articles/PostgreSQL_pg-randomness_Shannon_entropy_and_chi_square.php Wed, 17 Mar 2010 13:37:33 +0000 PostgreSQL has many great procedural languages, such as PL/pgSQL or PL/Python. Although those are usually much easier to create, sometimes it is necessary to create PostgreSQL C library functions. This article gives an example of such library functions working with bytea values as input. http://www.christian-rossow.de/articles/PostgreSQL_C_language_functions_with_bytea.php http://www.christian-rossow.de/articles/PostgreSQL_C_language_functions_with_bytea.php Mon, 15 Mar 2010 13:37:33 +0000 This article explains why applying tcpdump/libpcap BPF filters on mixed tagged VLAN and untagged ethernet traffic requires great caution. There reason for that is the magic 'vlan' keyword shifts all filters by 4 bytes to the right. http://www.christian-rossow.de/articles/tcpdump_filter_mixed_tagged_and_untagged_VLAN_traffic.php http://www.christian-rossow.de/articles/tcpdump_filter_mixed_tagged_and_untagged_VLAN_traffic.php Sat, 28 Nov 2009 13:37:33 +0000 After an absence of almost a year, some news again. Most important, I finished my studies at the VU Amsterdam in August. But there is other news. http://www.christian-rossow.de/articles/MSc_finished.php http://www.christian-rossow.de/articles/MSc_finished.php Sun, 27 Sep 2009 13:37:33 +0000 A talk at the Fifth Conference on Email and Anti-Spam CEAS 2008 allowed me travelling to the US the first time. In addition to the conference, I had three great months of holidays. http://www.christian-rossow.de/articles/research_5.php http://www.christian-rossow.de/articles/research_5.php Thu, 09 Oct 2008 13:37:33 +0000 Together with Christian Dietrich, I have been presenting some IP blacklisting research results. Where you could and can see us is written in this short report. http://www.christian-rossow.de/articles/research_4.php http://www.christian-rossow.de/articles/research_4.php Tue, 01 Apr 2008 13:37:33 +0000 Today I had to learn for the functional language ML and I could not find any nice cheat sheet. I quickly produced my own version and offer it for a free download. http://www.christian-rossow.de/articles/ML_Cheat_Sheet.php http://www.christian-rossow.de/articles/ML_Cheat_Sheet.php Fri, 14 Dec 2007 13:37:33 +0000 Well, I finally returned from all activities I had during the last weeks. To summarize, I presented my research results at two conferences and at an advancement award of a German Internet Security association. And - I won it :) http://www.christian-rossow.de/articles/research_3.php http://www.christian-rossow.de/articles/research_3.php Tue, 20 Nov 2007 13:37:33 +0000 Since I promised to keep you up to date, I will do so. This week, from 22th to 26th October 2007, is the 55th RIPE meeting in Amsterdam. Without hesitation I applied for a speaking slot during a session of the anti-spam working group and was accepted. http://www.christian-rossow.de/articles/research_2.php http://www.christian-rossow.de/articles/research_2.php Wed, 24 Oct 2007 13:37:33 +0000 From April to September 2007 I finished my bachelor thesis. It covers anti-spam measures of European providers and gives interesting data of a survey conducted by ENISA. Furthermore it contains results of blacklisting research I did during the last months. http://www.christian-rossow.de/articles/research_1.php http://www.christian-rossow.de/articles/research_1.php Thu, 13 Sep 2007 13:37:33 +0000 This article is supposed to give you a quick start guide to create your own aggregate functions within the open source database PostgreSQL. It should assist you by understanding the official documentation and answers some questions, which came up to me during my first attempts. http://www.christian-rossow.de/articles/PostgreSQL_Aggregate_Functions.php http://www.christian-rossow.de/articles/PostgreSQL_Aggregate_Functions.php Wed, 21 Feb 2007 13:37:33 +0000