Re: [cti-users] Darknet

[Eric Ziegast <ziegast@fsi.io>]

Clarification, which are you talking about?

  "Dark Web" (web sites you might access via Tor or other restricted
              access)

or

  "Darknet" (packets going to "unlit" parts of the Internet
             that are passively logged).

or

  Something else?


FSI makes raw darknet data streams available to industry and
researchers, and some researchers at Concordia Univ developed some
heuristics and results in JSON around backscatter-related "DDoS events"
observed in the Darknet data.


Could you be more specific abut what you're looking for?

--
Eric Ziegast
Farsight Security
ziegast@fsi.io


Back, Greg wrote:
> Hi, I personally haven't done anything related to using STIX, CybOX or TAXII to represent Darknet activity, but perhaps someone else on the list has more experience. You might get more responses if you have specific questions about what you're trying to do.
> 
> Greg
> 
>> -----Original Message-----
>> From: Sotirios Raptis [mailto:sraptis@uom.edu.gr]
>> Sent: Thursday, September 08, 2016 12:41 PM
>> To: Back, Greg <gback@mitre.org>
>> Cc: cti-users@lists.oasis-open.org
>> Subject: Re: [cti-users] libtaxii 1.1.110 released
>>
>> Hi there,
>>
>> I'm interested in STIX, CYBOX and TAXII relations with the Darknet.
>>
>> Please any help.
>>
>> Thanks
>>
>>
>> Σωτήριος Μ. Ράπτης
>> --
>> Sotirios M. Raptis
>> ICT Security Researcher
>> Member of Information Security Research Group (InfoSec)
>> (http://infosec.uom.gr) University of Macedonia (UOM), 156 Egnatia str,
>> 54006 Thessaloniki, Greece
>> tel: +302310891841 | fax: +302310891812 | email: sraptis@uom.edu.gr
>> <mailto:sraptis@uom.edu.gr> , sraptis@uom.gr <mailto:sraptis@uom.gr>