Detecting HTTP tunnels with statistical mechanisms

IEEE International Conference on Communications

Volumn , Issue , 2007, Pages 6162-6168

  Crotti, Manuel ^a   Dusi, Maurizio ^a   Gringoli, Francesco ^a   Salgarelli, Luca ^a  

^a UNIVERSITY OF BRESCIA   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

PACKET NETWORKS; PROBLEM SOLVING; STATISTICAL METHODS; TELECOMMUNICATION TRAFFIC; TUNNELS;

CLASSIFICATION TECHNIQUE; ENFORCE SECURITY POLICIES; PACKETS CROSSING;

HTTP;

EID: 38549174159     PISSN: 05361486     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICC.2007.1020     Document Type: Conference Paper

References (21)

1. Jake Hill. Bypassing Firewalls: Tools and Techniques. In 12th Annual FIRST Conference, Chicago, IL, USA, June 2000.
2. L. Brinkhoff. GNU httptunnel. http://www.nocrew.org/software/httptunnel. html.
3. F. Heinz and J. Oster. DNS tunnel, http://nstx.dereference.de/nstx.
4. R. Mills. The Linux Academy HTTP Tunnel. http://the-linux-academy.co.uk/ downloads.htm.
5. M. Crotti, M. Dusi, F. Gringoli, and L. Salgarelli. Traffic Classification through Simple Statistical Fingerprinting. ACM SIGCOMM Computer-Communication Review, 37(1):7-16, January 2007.
6. V. Paxson. Bro: a system, for detecting network intruders in real-time. Computer Networks, 31(23-24):2435-2463, 1999.
7. M. Roesch. SNORT: Lightweight Intrusion Detection for Networks. In LISA '99: Proceedings of the 13th USENIX Conference on Systems Administration, pages 229-238, Seattle, WA, USA, November 1999.
8. S. Dharmapurikar, P. Krishnamurthy, T.S. Sproull, and J.W. Lockwood. Deep packet inspection using parallel bloom filters. IEEE/Micro, 24(1):52-61, 2004.
9. T. Kocak and I. Kaya. Low-power bloom filter architecture for deep packet inspection. IEEE/Communications Letters, 10(3):210-212, 2006.
10. A. Broder and M. Mitzenmacher. Network applications of bloom filters: a survey. Internet Mathematics, 1(4):485-509, 2003.
11. V. Paxson. Empirically derived analytic models of wide-area TCP connections. IEEE/ACM Trans. Netw., 2(4):316-336, 1994.
12. V. Paxson and S. Floyd. Wide area traffic: the failure of Poisson modeling. IEEE/ACM Trans. Netw., 3(3):226-244, 1995.
13. F. Hernández-Campos, F. Donelson Smith, K. Jeffay, and A. B. Nobel. Statistical Clustering of Internet Communications Patterns. In Computing Science and Statistics, volume 35, July 2003.
14. A. McGregor, M. Hall, P. Lorier, and J. Brunskill. Flow Clustering Using Machine Learning Techniques. In Proceedings of the 5th Passive and Active Measurement Workshop (PAM 2004), pages 205-214, Antibes Juan-les-Pins, France, March 2004.
15. M. Roughan, S. Sen, O. Spatscheck, and N. Duffield. Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification. In IMC '04: Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, pages 135-148, Taormina, Sicily, Italy, October 2004.
16. A. W. Moore and D. Zuev. Internet traffic classification using bayesian analysis techniques. In SIGMETRICS '05: Proceedings of the 2005 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, pages 50-60, Banff, Alberta, Canada, June 2005.
17. T. Karagiannis, K. Papagiannaki, and M. Faloutsos. BLINC: multilevel traffic classification in the dark. In SIGCOMM'05: Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, pages 229-240, Philadelphia, PA, USA, August 2005.
18. L. Bernaille, R. Teixeira, I. Akodkenou, A. Soule, and K. Salamatian. Traffic Classification On The Fly. ACM Computer Communication Review, 36(2):23-26, April 2006.
19. George Bissias, Marc Liberatore, David Jensen, and Brian Neil Levine. Privacy Vulnerabilities in Encrypted HTTP Streams. In Proc. Privacy Enhancing Technologies Workshop (PET 2005), 2005.
20. Kevin Borders and Atul Prakash. Web tap: detecting covert web traffic. In CCS'04: Proceedings of the 11th ACM conference on Computer and communications security, pages 110-120, New York, NY, USA, 2004. ACM Press.
21. Tcpdump/Libpcap. http://www.tcpdump.org.