The deployment of a darknet on an organization-wide network: An empirical analysis

Proceedings of IEEE International Symposium on High Assurance Systems Engineering

Volumn , Issue , 2008, Pages 59-68

  Berthier, Robin ^a   Mcukier, Michel Cukier ^a  

^a UNIVERSITY OF MARYLAND   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

INTERNET PROTOCOLS; SENSORS; SYSTEMS ENGINEERING;

ATTACK TRAFFIC; DARKNET; INTERNET PROTOCOL (IP) ADDRESSES;

SENSOR NETWORKS;

EID: 58449095671     PISSN: 15302059     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HASE.2008.54     Document Type: Conference Paper

References (27)

1. State, R., Francois, J., Festor, O.. Tracking global wide configuration errors. IEEE / IST Workshop on Monitoring, Attack Detection and Mitigation, 2006.
2. Raynal, F. and Berthier, Y. and Biondi, P. and Kaminsky, D., "Honeypot Forensic", IEEE Information Assurance Conference, June 2004.
3. Vrable, M. and Ma, J. and Chen, J. and Moore, D. and Vandekieft, E. and Snoeren, A.C. and Voelker, G.M. and Savage, S., "Scalability, fidelity, and containment in the potemkin virtual honeyfarm", ACM SIGOPS Operating Systems Review, 39(5): 148-162, 2005.
4. Bächer P. and Holz T. and Kötter M. and Wicherski G., "Know Your Enemy: Tracking Botnet", http://www.honeynet.org/papers/ bots/, 2005.
5. Keribich C. and Crowcroft. J., "Honeycomb - creating intrusion detection signatures using honeypots", In Proceedings of the 2nd workshop on Hot Topic in Network, Boston, MA, 2003.
6. Baecher, P. and Koetter, M. and Holz, T. and Dornseif, M. and Freiling, F., "The Nepenthes Platform: An Efficient Approach to Collect Malware", Proceedings of Recent Advances in Intrusion Detection (RAID), September 2006,
7. Moore, D. and Shannon, C. and Brown, D.J. and Voelker, G.M. and Savage, S., "Inferring Internet denial-of-service activity", ACM Transactions on Computer Systems (TOCS), 24(2): 115-139, 2006.
8. th USENIX Security Symposium, 2002.
9. Cooke, E. and Bailey, M. and Mao, Z.M. and Watson, D. and Jahanian, F. and McPherson, D., "Toward understanding distributed blackhole placement", Proceedings of the 2004 ACM workshop on Rapid malcode, pages 54-64, 2004.
10. Cisco Systems Inc. Netflow. 2008. http://www.cisco.com/go/netflow
11. Team CYMRU. The darknet project. http://www.cymru.com/Darknet/index.html, June 2004.
12. Dug Song, Rob Malan, and Robert Stone. A snapshot of global Internet worm activity. FIRST Conference on Computer Security Incident Handling and Response, June 2002.
13. David Moore, Colleen Shannon, Geoffrey M. Voelker, and Stefan Savage. Network telescopes. Technical Report CS2004-0795, UC San Diego, July 2004.
14. Michael Bailey, Evan Cooke, Tim Battles, and Danny McPherson. Tracking global threats with the Internet Motion Sensor. 32nd Meeting of the North American Network Operators Group, October 2004.
15. Jung, J. and Paxson, V. and Berger, AW and Balakrishnan, H. Fast portscan detection using sequential hypothesis testing. Security and Privacy, 2004. Proceedings. 2004 IEEE Symposium on. pages 211-225, 2004.
16. Bailey, M. and Cooke, E. and Jahanian, F, and Myrick, A. and Sinha, S.: Practical Darknet Measurement. In 40th Annual Conference on Information Sciences and Systems, 2006.
17. Bailey, M. Evan Cooke and Jahanian, F. and Provos, N. and Rosaen, K. and Watson, D.: Data reduction for the scalable automated analysis of distributed darknet traffic. In Proceedings of the Internet Measurement Conference, 2005.
18. L. T. Heberlein, G. V. Dias, K. N. Levitt, B. Mukherjee, J. Wood, and D. Wolber. A network security monitor. In Proc. IEEE Symposium on Research in Security and Privacy, pages 296-304, 1990.
19. th Conference on Systems Administration (LISA-99), pages 229-238, Berkeley, CA, Nov.7-12 1999.
20. S. Robertson, E. V. Siegel, M. Miller, and S. J. Stolfo. Surveillance detection in high bandwidth environments. In Proceedings of the 2003 DARPA DISCEX III Conference, pages 130 -139, Washington, DC, 2003. IEEE Press. 22-24 April 2003.
21. C. Leckie and R. Kotagiri. A probabilistic approach to detecting network scans. In Proceedings of the Eighth IEEE Network Operations and Management Symposium (NOMS 2002), pages 359-372, Florence, Italy, Apr. 2002.
22. Peter Haag, Nfdump: http://nfdump.sourceforge.net Nfsen:http://nfsen. sourceforge.net
23. Guo, D., Gahegan, M., Peuquet, D., & MacEachren, A., "Breaking Down Dimensionality: An Effective Feature Selection Method for High-Dimensional Clustering", Workshop on Clustering High Dimensional Data and its Applications, the Third SIAM International Conference on Data Mining, San Francisco, CA, May 2003.
24. Yegneswaran, V. and Barford, P. and Plonka, D., "On the Design and Use of Internet Sinks for Network Abuse Monitoring", Proceedings of Symposium on Recent Advances in Intrusion Detection (RAID), September 2004.
25. th USENIX Security Symposium, pages 15-28, 2004.
26. Provos, N., "A Virtual Honeypot Framework", Proceedings of the 13th USENIX Security Symposium, pages 1-14, 2004.
27. Bailey, M. and Cooke, E. and Watson, D. and Jahanian, F. and Provos, N., "A hybrid honeypot architecture for scalable network monitoring", CSE Technical Report CSE-TR-499-04, University of Michigan, Ann Arbor, October 2004.