Open Data at CIRCL on CIRCL

CIRCL Images AIL Dataset - Open Data at CIRCL

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

CERTs such as CIRCL and security teams collect and process content such as images (at large from photos, screenshots of websites or screenshots of sandboxes). Datasets become larger - e.g. on average 10000 screenshots of onion domains websites are scrapped each day in AIL - Analysis Information Leak framework, an analysis tool of information leak - and analysts need to classify, search and correlate through all the images.

Automatic tools can help them in this task. Less research about image matching and image classification seems to have been conducted exclusively on websites screenshots. However, a classification of this kind of pictures needs to be addressed.

CIRCL Images Phishing Dataset - Open Data at CIRCL

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

Operational Statistics

Mon, 01 Jan 0001 00:00:00 +0000

CIRCL Operational Statistics

Operational Statistics

CIRCL Operational Statistics

The operational statistics cover the activities related to the incident response activities of CIRCL especially in regards to the reporting (e.g. incident reports, request for analysis or support during computer security incident) and notifications (e.g. take-down notification, notification about vulnerability) from/to third parties. The statistics exclude automatic structured notifications and information exchange happening via threat intelligence platforms such as the CIRCL MISP information sharing platform or any other automatic exchange setup with partners.

In this section some statistics are presented about incidents handled by CIRCL between 2016 and 2026. During this time frame the attackers evolved, forcing CIRCL to adapt its internal procedures. Although the reporting to CIRCL is not mandatory, the reporting behaviour of constituents has changed. On one hand, the reputation of CIRCL increased, thereby increasing the amount of reporting to CIRCL. On the other hand, due to the trainings such as Introduction to incident response, forensic analysis and many others offered by CIRCL, have helped local organisations build up their own incident response capacities thereby reducing the number of reported incidents. This makes comparing the statistics of successive years challenging. Tickets are no indicators for the overall workload as there are some tickets that are very resource intensive whereas others are quickly solved. Nevertheless, the workload for the overall triage of the tickets is increasing and showing an increase in diversity when it comes to attacker practices.

Ticketing System Statistics

Tickets can contain one or more incidents and only represent the reporting or notification which was performed by CIRCL analysts.

Small precision regarding the charts:

- Manual Ticket: Ticket that has to be handled and classified manually by an analyst.
- Automatic Ticket: Ticket that was created in an automated fashion. Could be report from third parties or self generated report from our constituency. Tickets from not fully trusted sources involve a manual validation by a human CIRCL operator.
- Services offered by CIRCL: CIRCL offers multiple services such as MISP, PassiveDNS, PassiveSSL, AILFramework and many more to organisations. Tickets for services are usually questions or request for access.

On smaller screens, scroll the charts horizontally to view all of their content.