Online sketching of network flows for real-time stepping-stone detection

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2009, Pages 473-483

  Coskun, Baris ^a   Memon, Nasir ^a  

^a POLYTECHNIC UNIVERSITY   (United States)

Author keywords

Data sketching; Network security; Stepping stones; Streaming algorithms

Indexed keywords

CONSTANT TIME; DETECTION PERFORMANCE; NETWORK BOUNDARIES; NETWORK FLOWS; ON-LINE ALGORITHMS; ON-LINE SKETCHING; QUADRATIC TIME; RANDOM DELAY; ROBUSTNESS PROPERTIES; SCALABLE SOLUTION; STEPPING STONE; STREAMING ALGORITHM; TIME-STEPPING; TIMING CHARACTERISTICS;

COMPUTER APPLICATIONS; TIME MEASUREMENT;

NETWORK SECURITY;

EID: 77950825753     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2009.51     Document Type: Conference Paper

References (28)

1. G. Cormode and S. Muthukrishnan, "An improved data stream summary: The count-min sketch and its applications," J. Algorithms, vol.55, pp. 29-38, 2004.
2. M. Charikar, K. Chen, and M. Farach-Colton, "Finding frequent items in data streams," in ICALP '02: Proceedings of the 29th International Colloquium on Automata, Languages and Programming. London, UK: Springer-Verlag, 2002, pp. 693-703.
3. A. C. Gilbert, Y. Kotidis, S. Muthukrishnan, and M. J. Strauss, "How to summarize the universe: Dynamic maintenance of quantiles," in In VLDB, 2002, pp. 454-465.
4. D. Schnackenberg, H. Holliday, R. Smith, K. Djahandari, and D. Sterne, "Cooperative intrusion traceback and response architecture (citra)," in Proceedings of the DARPA Information Survivability Conference and Exposition, 2001.
5. D. Schnackenberg, K. Djahandari, and D. Steme, "Infrastructure for intrusion detection and responsen," in Proceedings of the DARPA Information Survivability Conference and Exposition, 2000.
6. Y. Zhang and V. Paxson, "Detecting stepping stones," in Proceedings of the 9th USENIX Security Symposium, August 2000, pp. 171-184.
7. A. Blum, D. Song, and S. Venkataraman, "Detection of interactive stepping stones: Algorithms and confidence bounds," in Conference of Recent Advance in Intrusion Detection (RAID), Sophia Antipolis, French Riviera, France, September 2004.
8. K. Yoda and H. Etoh, "Finding a connection chain for tracing intruders," in F. Guppens, Y. Deswarte, D. Gollamann, and M. Waidner, editors, 6th European Symposisum on Research in Computer Security - ESORICS 2000 LNCS -1985, Toulouse, France, October 2000.
9. L. Zhang, A. Persaud, A. Johnson, and Y. Guan, "Stepping stone attack attribution in non-cooperative ip networks," in roceedings of the 25th IEEE International Performance Computing and Communications Conference (IPCCC 2006), April 2006.
10. H.-C. Wu and S.-H. S. Huang, "Detecting stepping-stone with chaff perturbations," in AINAW '07: Proceedings of the 21st International Conference on Advanced Information Networking and Applications Workshops, 2007, pp. 85-90.
11. D. Donoho, A. G. Flesia, U. Shankar, V. Paxson, J. Coit, and S. Staniford, "Multiscale stepping-stone detection: Detecting pairs of jittered interactive streams by exploiting maximum tolerable delay," in Fifth International Symposium on Recent Advances in Intrusion Detection, Lecture Notes in Computer Science 2516, New York, Springer, 2002.
12. J. Haitsma and T. Kalker, "A highly robust audio fingerprinting system with an efficient search strategy," Journal of New Music Research, vol.32, no.2, pp. 211-221, 2003.
13. X. Fu, B. Graham, R. Bettati, and W. Zhao, "On effectiveness of link padding for statistical traffic analysis attacks," in ICDCS '03: Proceedings of the 23rd International Conference on Distributed Computing Systems, 2003, p. 340.
14. P. Venkitasubramaniam and L. Tong, "Anonymous networking with minimum latency in multihop networks," in SP '08: Proceedings of the 2008 IEEE Symposium on Security and Privacy (sp 2008), 2008, pp. 18-32.
15. W. Wang, M. Motani, and V. Srinivasan, "Dependent link padding algorithms for low latency anonymity systems," in CCS '08: Proceedings of the 15th ACM conference on Computer and communications security, 2008, pp. 323-332.
16. X. Wang and D. S. Reeves, "Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays," in CCS '03: Proceedings of the 10th ACM conference on Computer and communications security, 2003, pp. 20-29.
17. Y. J. Pyun, Y. H. Park, X. Wang, D. Reeves, and P. Ning, "Tracing traffic through intermediate hosts that repacketize flows," in INFOCOM 2007. 26th IEEE International Conference on Computer Communications. IEEE, 2007, pp. 634-642.
18. A. Houmansadr, N. Kiyavash, and N. Borisov, "Rainbow: A robust and invisible non-blind watermark for network flows," in NDSS'09: 16th Annual Network and Distributed System Security Symposium, 2009.
19. S. Staniford-Chen and L. Heberlein, "Holding intruders accountable on the internet," in Proc. IEEE Symposium on Security and Privacy, Oakland, CA, May 1995, p. 3949.
20. T. He and L. Tong, "A signal processing perspective of stepping-stone detection," in Proc. of IEEE CISS'06, Princeton, NJ, 2006.
21. X. Wang, D. S. Reeves, and S. F. Wu, "Inter-packet delay based correlation for tracing encrypted connections through stepping stone," in Proceedings of the 7th European Symposium on Research in Computer Securit, (ESORICS, 2002, pp. 244-263.
22. W. T. Strayer, C. E. Jones, I. Castineyra, J. B. Levin, and R. R. Hain, "An integrated architecture for attack attribution," in BBN Technologies, Tech. Rep. BBN REPORT-8384, December 2003.
23. K. Suh, D. Figueiredo, J. Kurose, and D. Towsley, "Characterizing and detecting skype-relayed traffic," in Proc. of Infocom, 2006.
24. B. Coskun and N. Memon, "Efficient detection of delay-constrained relay nodes," in ACSAC'07: 23rd Annual Computer Security Applications Conference, Miami Beach, FL, Dec 2007.
25. X. Wang, S. Chen, and S. Jajodia, "Tracking anonymous peer-to-peer voip calls on the internet," in CCS '05: Proceedings of the 12th ACM conference on Computer and communications security, 2005, pp. 81-91.
26. A. C. Gilbert, Y. Kotidis, S. Muthukrishnan, and M. Strauss, "Surfing wavelets on streams: One-pass summaries for approximate aggregate queries," in VLDB '01: Proceedings of the 27th International Conference on Very Large Data Bases, 2001, pp. 79-88.
27. R. Venkatesan, S. Koon, M. Jakubowski, and P. Moulin, "Robust image hashing," in Proc. IEEE Int. Conf. Image Processing, 2000.
28. J. Fridrich, "Robust bit extraction from images," in ICMCS '99, Florence, Italy, June 1999.