Posts Tagged ‘ISP’

NoAH: a versatile tool for every ISP’s toolbox

Wednesday, July 9th, 2008

The primary purpose of NoAH system is detection of unauthorized activity on organizational data networks. It does this by monitoring the activity on all the unused IPs in your network. Any attempted connection to an unused IP address is assumed to be unauthorized or malicious activity. In the case where the system IP is in use the system (honey@home) can monitor unused service ports of the system and report activity.

Even though the aim of the project is to help NRENs and ISPs companies, feedback from them is crucial, since the main attacks committed through their networks. Using NoAH system can help detect, monitor and report suspect activities in real-time.

NoAH system main features:

  • Provide source of data for security analysis.
  • Produce attacks signatures for further use (integration with IDS, firewalls and other network protection tools).
  • It has few false positives, low cost and low risk.
  • It does not capture legitimate users traffic (No sensitive data).
  • Help the security teams understand the threats they face and how to defend against them.
  • Raw data available for the administrators.
  • Easy to adapt new honeypots on the company‚Äôs network.
  • Open-source software.
  • Contribute to a large network of Honeypots.