{"id":"https://openalex.org/W2575270149","doi":"https://doi.org/10.14722/ndss.2016.23427","title":"Cache, Trigger, Impersonate: Enabling Context-Sensitive Honeyclient Analysis On-the-Wire","display_name":"Cache, Trigger, Impersonate: Enabling Context-Sensitive Honeyclient Analysis On-the-Wire","publication_year":2016,"publication_date":"2016-01-01","ids":{"openalex":"https://openalex.org/W2575270149","doi":"https://doi.org/10.14722/ndss.2016.23427","mag":"2575270149"},"language":"en","primary_location":{"id":"doi:10.14722/ndss.2016.23427","doi":"https://doi.org/10.14722/ndss.2016.23427","is_oa":true,"landing_page_url":"https://doi.org/10.14722/ndss.2016.23427","pdf_url":"https://doi.org/10.14722/ndss.2016.23427","source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2016 Network and Distributed System Security Symposium","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://doi.org/10.14722/ndss.2016.23427","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5111373813","display_name":"Teryl Taylor","orcid":"https://orcid.org/0000-0002-4915-1286","observed_orcids":["https://orcid.org/0000-0002-4915-1286"]},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Teryl Taylor","raw_affiliation_strings":["University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019527145","display_name":"Kevin Z. Snow","orcid":"https://orcid.org/0009-0007-3666-9880","observed_orcids":["https://orcid.org/0009-0007-3666-9880"]},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kevin Z. Snow","raw_affiliation_strings":["University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041764761","display_name":"Nathan Otterness","orcid":"https://orcid.org/0000-0001-6739-4081","observed_orcids":["https://orcid.org/0000-0001-6739-4081"]},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nathan Otterness","raw_affiliation_strings":["University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5069862528","display_name":"Fabian Monrose","orcid":"https://orcid.org/0000-0002-9805-2217","observed_orcids":["https://orcid.org/0000-0002-9805-2217"]},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Fabian Monrose","raw_affiliation_strings":["University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I114027177"],"apc_list":null,"apc_paid":null,"fwci":1.1392,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":{"value":0.7792477,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":96},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7993000149726868,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7993000149726868,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.17430000007152557,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.00430000014603138,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/network-intrusion-detection","display_name":"network intrusion detection","score":0.824999988079071}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.767981231212616},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.7002398371696472},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.55755615234375},{"id":"https://openalex.org/C173608175","wikidata":"https://www.wikidata.org/wiki/Q232661","display_name":"Parallel computing","level":1,"score":0.453222393989563},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.3606341779232025},{"id":"https://openalex.org/C118524514","wikidata":"https://www.wikidata.org/wiki/Q173212","display_name":"Computer architecture","level":1,"score":0.35933607816696167},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3231261968612671},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.08829092979431152},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.14722/ndss.2016.23427","doi":"https://doi.org/10.14722/ndss.2016.23427","is_oa":true,"landing_page_url":"https://doi.org/10.14722/ndss.2016.23427","pdf_url":"https://doi.org/10.14722/ndss.2016.23427","source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2016 Network and Distributed System Security Symposium","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.14722/ndss.2016.23427","doi":"https://doi.org/10.14722/ndss.2016.23427","is_oa":true,"landing_page_url":"https://doi.org/10.14722/ndss.2016.23427","pdf_url":"https://doi.org/10.14722/ndss.2016.23427","source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2016 Network and Distributed System Security Symposium","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G6599608564","display_name":"TWC: TTP Option: Small: Collaborative: Scalable Techniques for Better Situational Awareness: Algorithmic Frameworks and Large-Scale Empirical Analyses","funder_award_id":"1421703","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7447076839","display_name":"SDCI Sec: New Software Platforms for Supporting Network-wide Detection of Code Injection Attacks","funder_award_id":"1127361","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320306110","display_name":"U.S. Department of Homeland Security","ror":"https://ror.org/00jyr0d86"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2575270149.pdf","grobid_xml":"https://content.openalex.org/works/W2575270149.grobid-xml"},"referenced_works_count":36,"referenced_works":["https://openalex.org/W17155033","https://openalex.org/W88849960","https://openalex.org/W102746433","https://openalex.org/W155384935","https://openalex.org/W191656338","https://openalex.org/W1480813933","https://openalex.org/W1491237615","https://openalex.org/W1516506771","https://openalex.org/W1674877186","https://openalex.org/W1773541209","https://openalex.org/W1970867218","https://openalex.org/W1975909792","https://openalex.org/W1985683032","https://openalex.org/W1987117885","https://openalex.org/W2012481173","https://openalex.org/W2049092543","https://openalex.org/W2053307247","https://openalex.org/W2082180526","https://openalex.org/W2083391339","https://openalex.org/W2095610745","https://openalex.org/W2102475112","https://openalex.org/W2119026482","https://openalex.org/W2138644293","https://openalex.org/W2146729596","https://openalex.org/W2158302406","https://openalex.org/W2159710624","https://openalex.org/W2168154523","https://openalex.org/W2176830056","https://openalex.org/W2182421051","https://openalex.org/W2473839235","https://openalex.org/W2538335023","https://openalex.org/W4237793107","https://openalex.org/W6961084157","https://openalex.org/W7043646840","https://openalex.org/W7073872665","https://openalex.org/W7075325720"],"related_works":["https://openalex.org/W2954335592","https://openalex.org/W40177048","https://openalex.org/W2052398417","https://openalex.org/W1980825054","https://openalex.org/W2027049472","https://openalex.org/W2350244412","https://openalex.org/W7056946723","https://openalex.org/W1546208906","https://openalex.org/W4386160548","https://openalex.org/W2800979301"],"abstract_inverted_index":{"Today's":[0],"sophisticated":[1],"web":[2,56],"exploit":[3,166,187],"kits":[4,167],"use":[5,122],"polymorphic":[6],"techniques":[7],"to":[8,48,68,105,126,134,145],"obfuscate":[9],"each":[10],"attack":[11],"instance,":[12],"making":[13],"content-based":[14],"signatures":[15,80],"used":[16],"by":[17,159],"network":[18,75],"intrusion":[19],"detection":[20],"systems":[21,104],"far":[22],"less":[23],"effective":[24],"than":[25],"in":[26,41,46,71],"years":[27],"past.A":[28],"dynamic":[29],"analysis,":[30,33],"or":[31,85],"honeyclient":[32,147,203],"of":[34,63,97,117,130,156,164,185],"these":[35,186],"exploits":[36],"plays":[37],"a":[38,98,114,135,161,172,201,208],"key":[39],"role":[40],"initially":[42],"identifying":[43],"new":[44],"attacks":[45,70],"order":[47],"generate":[49],"content":[50,124,143],"signatures.While":[51],"honeyclients":[52],"can":[53,205],"sweep":[54],"the":[55,93,128,140,146,154,183],"for":[57,101],"attacks,":[58],"they":[59,169],"provide":[60,178],"no":[61],"means":[62],"inspecting":[64],"end-user":[65],"traffic":[66],"on-the-wire":[67,107],"identify":[69],"real":[72],"time.This":[73],"leaves":[74],"operators":[76],"dependent":[77],"on":[78,149],"third-party":[79],"that":[81,193],"arrive":[82],"too":[83],"late,":[84],"not":[86],"at":[87,108],"all.In":[88],"this":[89],"paper,":[90],"we":[91,110],"introduce":[92],"design":[94],"and":[95,112,200],"implementation":[96],"novel":[99],"framework":[100,158],"adapting":[102],"honeyclient-based":[103],"operate":[106],"scale.Specifically,":[109],"capture":[111],"store":[113],"configurable":[115],"window":[116],"reassembled":[118],"HTTP":[119],"objects":[120],"networkwide,":[121],"lightweight":[123],"rendering":[125],"establish":[127],"chain":[129],"requests":[131],"leading":[132],"up":[133],"suspicious":[136],"event,":[137],"then":[138],"serve":[139],"initial":[141],"response":[142],"back":[144],"system":[148],"an":[150],"isolated":[151],"network.We":[152],"demonstrate":[153],"power":[155],"our":[157,189,194],"analyzing":[160],"diverse":[162],"collection":[163],"web-based":[165],"as":[168],"evolve":[170],"over":[171],"one":[173],"year":[174],"period.Our":[175],"case":[176],"studies":[177],"several":[179],"interesting":[180],"insights":[181],"into":[182],"behavior":[184],"kits.Additionally,":[188],"empirical":[190],"evaluations":[191],"suggest":[192],"approach":[195],"offers":[196],"significant":[197],"operational":[198],"value,":[199],"single":[202],"server":[204],"readily":[206],"support":[207],"large":[209],"campus":[210],"deployment.":[211]},"counts_by_year":[{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":1},{"year":2017,"cited_by_count":2}],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2017-01-26T00:00:00"}