1. Activities
     Data collection    Data analysis    Network reporting    Investigation support  

2. References

3. External links

Shadowserver Foundation is a nonprofit security organization^[1] that gathers and analyzes data on malicious Internet activity (including malware, botnets, and computer fraud), sends daily network reports to subscribers, and works with law enforcement organizations around the world^[2] in cybercrime investigations. Established in 2004^[3] as a "volunteer watchdog group,"^[4] it liaises with national governments, CSIRTs, network providers, academic institutions, financial institutions, Fortune 500 companies, and end users to improve Internet security, enhance product capability, advance research, and dismantle criminal infrastructure.

Activities

Data collection

Shadowserver scans the IPv4 Internet 30 times per day. It harvests data on malware, spam, bots, and botnets^[5] using large-scale sensor networks of honeypots and honeyclients^[6] placed throughout the world. It uses sinkholes to collect data on bots and DDOS attacks. It also receives additional malware and sinkhole data from governments, industry partners, and law enforcement agencies that have established reciprocal data-sharing agreements with Shadowserver.

Data analysis

Shadowserver stores raw malware data permanently in its repository. As new data are collected, Shadowserver analyzes them using thousands of virtual sandboxes and hundreds of iron sandboxes. It regularly re-analyzes raw data previously collected. The results of these analyses are stored in the organization's analysis cluster.

Network reporting

Shadowserver sends daily custom reports to users who have subscribed to them. The reports contain all the data that Shadowserver has collected and analyzed about any suspicious activity it was able to detect within the specific networks or regions for which the subscriber is responsible. For example, a national government might receive data aggregated by geo-spacial coordinates defined by latitude and longitude, while an international network provider might receive data filtered by ASN.

Investigation support

Shadowserver liaises with security organizations, national governments, and CSIRTs to dismantle global cybercrime networks; for example, it worked with the FBI, Europol, and Interpol to take down the Avalanche network in 2016.^[7] It also helps law enforcement partners to develop strategies against cyber security threats and to mitigate threats as they emerge, focusing on cases that involve criminal abuse of the Internet’s infrastructure.

References

External links

• {{Official website}}

• Dusko Ajder
• Dusko Dukic
• Dusko Durisic
• Dusk of Dawn
• Dusko Gojkovic
• Dusko Grujic
• Dusko Knezevic
• Dusko kostic
• Dusko Milinkovic
• Dusko Pijetlovic
• Dusko Radinovic
• Dusko Radinović
• Dusko Radovic
• Dusko Savanovic
• Dusko Savic
• Dusko Savić
• Dusko Stajic
• Dusko Stanojevic
• Duskovci
• Dusko Vujosevic
• Dusk Silver
• Dusk Til' Dawn
• Dusk till dawn
• Dusk Till Dawn (Ladyhawke song)
• Dusk Till Dawn: The Best of Capercaillie