Create different type of feeds based on mathematical models

[mlodic]

Right now, there are 2 feeds available based on the age of the indicator:

• recent: most recent IOCs seen in the last 3 days
• persistent: these IOCs are the ones that were seen regularly by the honeypots. This feeds will start empty once no prior data was collected and will become bigger over time.

But they are really simple. Maybe we could think about creating different kind of lists based on more reliable values.
This issue will need a complex research analysis.
Starting point could be the Stratosphere's research: https://www.stratosphereips.org/aip-tool

[regulartim]

I would like to work on this as part of my Master's thesis. Is there a possibility to talk to you about the topic?

[mlodic]

sure, can you contact me in private in the GSOC Honeynet Slack or Twitter?

• Slack chat
• Twitter