Subject: Re: [mile] Call For Information about IODEF implementation

From: Daisuke MIYAMOTO <[email-masked]>
Date: Wed, 7 Oct 2015 18:27:06 +0900

Hello, just a kindly reminder.

 According to Dr. Suzuki, NICT's Daedalus alert system will support (or
already was capable to use) message exchange with IODEF format. I am
willing to add new subsection.

 If you have any information, please tell me at this mailing list.

Best regards,
Daisuke

On 2015/07/24 19:24, Daisuke MIYAMOTO wrote:
> Hello!
> 
>  As I presented in IETF93, MILE implementation report
> is going to be completed. For additional improvement,
> please let us know information about such IODEF
> implementations that proprietary products, open source
> software, libraries, and so on.
> 
>  We would be appreciated for your information, thanks!
> 
> Best regards,
> Daisuke
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile
>

---

From: Mio SUZUKI <[email-masked]>
Date: Thu, 8 Oct 2015 22:42:06 +0900

Hello, Daisuke-san.

Thank you for your kind reminder.
As you mentioned, we plan to support IODEF format in our DAEDALUS system.
The system summary of DAEDALUS is as described below.

DAEDALUS is a real-time alert system based on a large-scale
darknet monitoring facility that has been deployed as a part of the
nicter system of NICT, Japan. DAEDALUS consists of an analysis center (i.e., nicter) and
several cooperate organizations. Each organization installs a darknet sensor
and establishes a secure channel between it and the analysis center,
and continuously forwards darknet traffic toward the center. In
addition, each organization registers the IP address range of its
livenet at the center in advance. When these distributed darknet sensors observe 
malware activities from the IP address of a cooperate organization, then 
the analysis center sends an alert to the organization.

If you want to know more detail, please read these papers.
http://dl.acm.org/citation.cfm?id=2379700
http://www.nict.go.jp/en/data/nict-news/NICT_NEWS_1403_E.pdf

Best regards,
Mio

> 2015/10/07 18:27 Daisuke MIYAMOTO <[email-masked]>
>