"LLM in the Shell: Generative Honeypots" to be presented at ESORICS 2023 Poster Session

"LLM in the Shell: Generative Honeypots" to be presented at ESORICS 2023 Poster Session

We are happy to announce that our researcher, Muris Sladić, will present our latest research, “LLM in the Shell: Generative Honeypots”, at the upcoming ESORICS conference poster session in The Hague, Netherlands, on Monday, September 25, 2023. Whether you plan to attend the conference or want to learn more about this research, check out our paper. Our research proposes a novel use of Large Language Models (LLMs) for dynamic on-the-fly creation and generation of more engaging honeypot environments.

Generating Your Own Blocklists with the Stratosphere AIP Framework

Generating Your Own Blocklists with the Stratosphere AIP Framework

In this blog post, we describe how to run AIP on a cloud instance server, to read from Zeek logs and generate your own blocklist feed of IPs to block. The blog is divided into five parts:  first, what is AIP; second, we describe how to set up a new cloud server in Digital Ocean; third, how to configure the cloud server with Zeek running; fourth, how to prepare the environment and configurations for AIP to run; and fifth, how to run AIP and generate your own blocklists.

Slips and the AI VPN presented at the 20th DIMVA Tool Arsenal in Hamburg, Germany

Slips and the AI VPN presented at the 20th DIMVA Tool Arsenal in Hamburg, Germany

The Stratosphere Laboratory focus on applied research at the intersection of machine learning, cybersecurity and helping others. As part of our research and social commitment we develop free software tools that can help the community. In this blog we will recount our experience participating in the 2023 (DIMVA) Tool Arsenal with two of our tools: Slips and the AI VPN.

The World of Malicious IPs: Creating Blocklists from Honeypot Traffic.

The World of Malicious IPs: Creating Blocklists from Honeypot Traffic.

A honeypot network is a security mechanism to detect and deflect potential cyber-attacks. It works by creating a decoy system that appears to be a valuable target for attackers. The honeypot is designed to lure attackers into interacting with it so that security researchers can monitor their activities and learn more about their tactics. By nature, the honeypots are hidden and do not form part of any production system. As they do not receive legitimate connections, all the interactions with the honeypots can be considered attacks.