On the difficulty of scalably detecting network attacks

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2004, Pages 12-20

  Levchenko, Kirill ^a   Paturi, Ramamohan ^a   Varghese, George ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Communication complexity; Network intrusion detection

Indexed keywords

ALGORITHMS; COMPUTER NETWORKS; COMPUTER SOFTWARE; COMPUTER SYSTEM FIREWALLS; INTERNET; SECURITY OF DATA; TELECOMMUNICATION TRAFFIC;

COMMUNICATION COMPLEXITY; COMPUTER COMMUNICATION NETWORK; NETWORK INSTRUSION DETECTION SYSTEMS (NIDS); SERVICE PROVIDER;

COMPUTER CRIME;

EID: 14844303748     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1030083.1030087     Document Type: Conference Paper

References (27)

1. N. Alon, Y. Matias, and M. Szegedy. "The Space Complexity of Approximating the Frequency Moments." STOC 1996, pp. 20-29.
2. CERT. "CERT Advisory CA-1996-21 TCP SYN Flooding and IP Spoofing Attacks." 1996.
3. CERT. "CERT Advisory CA-1997-28 IP Denial-of-Service Attacks." 1997.
4. Check Point Software Technologies, Ltd. http://www.checkpoint.com/
5. Cisco Systems, http://www.cisco.com/
6. F. Cohen. "A Mathematical Structure of Simple Defense Network Deceptions." Computers & Security 19 (2000), pp. 520-528.
7. C. Estan, G. Varghese. "New Directions in Traffic Measurement and Accounting: Focusing on the Elephants, Ignoring the Mice." ACM Transactions on Computer Systems 21 (3), pp. 270-313.
8. C. Estan, G. Varghese, M. Fisk. "Bitmap Algorithms for Counting Active Flows on High Speed Links." Internet Measurement Conference, 2003.
9. ForeScout Technologies, http://www.forescout.com/
10. Fortinet, Inc. http://www.fortinet.com/
11. Fyodor. "Remote OS detection via TCP/IP Stack FingerPrinting." http://www.insecure.org/nmap/nmap-fingerprinting-article.html
12. M. Handley, V. Paxson. "Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics." 10th USENIX Security Symposium, pp. 115-131.
13. C. Jin, H. Wang, and K. Shin. "Hop-Count Filtering: An Effective Defense Against Spoofed DDoS Traffic." ACM Conference on Computer and Communication Security (CCS). October 2003.
14. Juniper Networks, http://www.juniper.net/
15. B. Kalyanasundaram and G. Schnitger. "The Probabilistic Communication Complexity of Set Intersection." SIAM Journal on Discrete Mathematics 5 (4), pp. 545-557, 1992.
16. R. Kompella, S. Singh, G. Varghese. "On Scalable Attack Detection in the Network." ACM SIGCOMM Internet Measurement Conference, 2004.
17. E. Kushilevitz and N. Nisan. Communication Complexity, Cambridge University Press, 1997.
18. Mazu Networks, http://www.mazunetworks.com/
19. D. Moore, G. Voelker, and S. Savage. "Inferring Internet Denial-of-Service Activity." 10th USENIX Security Symposium, pp. 9-22.
20. Network Associates, Inc. http://www.nai.com/
21. NetScreen Technologies, Inc. http://www.netscreen.com/
22. V. Paxson. "Bro: A System for Detecting Network Intruders in Real-Time." 7th USENIX Security Symposium, pp. 31-52.
23. J. Postel. "Transmission Control Protocol." RFC 793.
24. J. Postel. "Internet Control Message Protocol." RFC 792.
25. Snort, http://www.snort.org/
26. TippingPoint Technologies. http://www.tippingpoint.com/
27. H. Wang, D. Zhang, and K. Shin. "Detecting SYN Flooding Attacks." IEEE INFOCOM, 2002.