The use of packet inter-arrival times for investigating unsolicited internet traffic

Proceedings - First International Workshop on Systematic Approaches to Digital Forensic Engineering

Volumn 2005, Issue , 2005, Pages 89-104

  Zimmermann, Jacob ^a   Clark, Andrew ^a   Mohay, George ^a   Pouget, Fabien ^b   Dacier, Marc ^b  

^a QUEENSLAND UNIVERSITY OF TECHNOLOGY   (Australia)

^b EURECOM   (France)

Author keywords

[No Author keywords available]

Indexed keywords

DATA ACQUISITION; DATA STRUCTURES; DISTRIBUTED COMPUTER SYSTEMS; INTERNET; TELECOMMUNICATION TRAFFIC;

BACKGROUND RADIATION; INTER-ARRIVAL TIME (IAT) PEAK VALUES; INTERNET TRAFFIC; PACKET INTER-ARRIVAL TIMES;

PACKET SWITCHING;

EID: 33847225917     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SADFE.2005.26     Document Type: Conference Paper

References (24)

1. Jose Nazario. Defense and Detection Strategies against Internet Worms. Artech House, 2004.
2. D. Geer. Malicious bots threaten network security. IEEE Computer, 38(1):18-20, 2005.
3. Pang Ruoming, Vinod Yenheswaran, Paul Barford, Vern Paxson, and Larry Peterson. Characteristics of internet background radiation. In Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, Taormina, Sicily, Italy, 2004.
4. Lance Spitzner. Honeypots - Tracking Hackers. Addison - Wesley, 2003.
5. Lance Spitzner. The Honeypot Project: Trapping the Hackers. IEEE Security and Privacy, 1:15, 2003.
6. Fabien Pouget and Marc Dacier. Honeypot-based forensics. In Proceedings of the Asia Pacific Information Technology Security Conference (AusCERT), 2004.
7. D. Moore, C. Shannon, and K. Claffy. CodeRed: A Case Study on the Spread and Victims of an Internet Worm. In Proceedings of ACM SIGCOMM Internet Measurement Workshop, Marseilles, France, 2002.
8. D. Moore, G. Voelker, and S. Savage. Inferring internet denial of service activity. In Proceedings of 2001 USENIX Security Symposium, Washington D.C., 2001.
9. Evan Cooke, Michael Bailey, Z. Morley May, Danny McPherson, David Watson, and Farnam Jahanian. Towards understanding distributed blackhole placement. In WORM'04, Washington D.C., 2004.
10. David Moore, Colleen Shannon, Geoffrey M. Voelker, and Stefan Savage. Network Telescopes: Technical Report, http://www.caida.org/outreach/papers/2004/ tr-2004-04/tr-2004-04.pdf, 2004.
11. Nicolas Vanderavero, Xavier Brouckaert, Olivier Bonaventure, and Baudouin Le Charlier. The HoneyTank: a scalable approach to collect malicious Internet traffic. In Proceedings of the International Infrastructure Survivability Workshop 2004 (IISW'04), Lisbon, Portugal, 2004.
12. F. Pouget, M. Dacier, and V. H. Pham. Towards a better understanding of internet threats to enhance survivability. In Proc. of the International Infrastructure Survivability Workshop (IISW'04), Lisbon, Portugal, 2004.
13. DShield: Distributed Intrusion Detection System, http://www.dshield.org.
14. Internet Storm Center, http://isc.sans.org/about.php.
15. Symantec. Internet threat reports. http://ses.Symantec.com/content.cfm? articleid=1539, 2004.
16. Symantec. DeepSight Threat Management System. http://enterprisesecurity. symantec.com/content/displaypdf.cfm?pdfid=301.
17. V. Yengeswaran, P. Barford, and J. Ullrich. Internet intrusions: Global characteristics and prevalence. In Proceedings of ACM SIGMETRICS 2003, San Diego, CA., 2003.
18. Herve Debar and David Lefranc. Observations on the internet traffic reaching broadband-connected users. In Proceedings of EICAR Conference, Copenhagen, Denmark, May 2003.
19. M. Zhou and S. D. Lang. Mining frequency content of network traffic for intrusion detection. In Proceedings of IASTED International Conference on Communication, Network and Information Security (CNIS 2003), December 2003.
20. The Leurre.com Home Page, http://www.leurrecom.org.
21. F. Pouget, M. Dacier, and V. H. Pham. Leurre.com: On the advantages of deploying a large scale distributed honeypot platform. In Proceedings of E-Crime and Computer Conference (ECCE'05), Monaco, March 2005.
22. Symantec Service Support. Ports used for communication in Norton AntiVirus Corporate Edition. http://servicel.symantec.com/SUPPORT/ent-security. nsf/docid/2000101210181048.
23. LURHQ and Corporation. Critical Microsoft Messenger Patch Released, October 2003.
24. LURHQ and Corporation. Windows Messenger Popup Spam on UDP Port 1026, June 2003.