HiFIND: A high-speed flow-level intrusion detection approach with DoS resiliency

Computer Networks

Volumn 54, Issue 8, 2010, Pages 1282-1299

  Li, Zhichun ^a   Gao, Yan ^a   Chen, Yan ^a  

^a NORTHWESTERN UNIVERSITY   (United States)

Author keywords

Attack resilience; Data streaming; Intrusion detection; Network monitoring; Network level security and protection; Statistical detection

Indexed keywords

ANALYSIS AND EVALUATION; ATTACK RESILIENCE; BOTNETS; DATA STREAMING; FALSE POSITIVE; FLOW-LEVEL; HIGH SPEED FLOWS; INTRUSION DETECTION APPROACHES; INTRUSION DETECTION SYSTEMS; NETWORK MONITORING; PACKET STREAMS; PORT SCANS; REVERSIBLE SKETCHES; STATISTICAL DETECTION; SYN FLOODING; WORM PROPAGATION;

COMPUTER CRIME; DATA FLOW ANALYSIS; DATA REDUCTION; HIGH SPEED NETWORKS; NETWORK SECURITY; PACKET NETWORKS; SPEED;

INTRUSION DETECTION;

EID: 77953234751     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comnet.2009.10.016     Document Type: Article

References (53)

1. Ryutov T., Neuman C., Kim D., and Zhou L. Integrated access control and intrusion detection for web servers. IEEE Transactions on Parallel and Distributed System 14 9 (2003) 841-850
2. Hofmeyr S., and Forrest S. Intrusion detection using sequences of system calls. Journal of Computer Security 6 (1998) 151-180
3. Paxson V. Bro: a system for detecting network intruders in real-time. Computer Networks 31 23-24 (1999) 2435-2463
4. M. Roesch, Snort: the lightweight network intrusion detection system, 2001. .
5. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, N. Weaver, The spread of the Sapphire/Slammer worm, 2003. .
6. S. Staniford, V. Paxson, N. Weaver, How to own the Internet in your spare time, in: Proceedings of the 11th USENIX Security Symposium, 2002.
7. S. Staniford, D. Moore, V. Paxson, N. Weaver, The top speed of flash worms, in: Proceedings of the ACM CCS WORM Workshop, 2004.
8. N. Weaver, V. Paxson, S. Staniford, R. Cunningham, Large scale malicious code: a research agenda, Tech. Rep. DARPA-sponsored report, 2003.
9. D. Moore, C. Shannon, G.M. Voelker, S. Savage, Internet quarantine: requirements for containing self-propagating code, in: Proceedings of the IEEE Infocom, 2003.
10. S. Sikka, G. Varghese, Memory-efficient state lookups with fast updates, in: Proceedings of the ACM SIGCOMM, 2000.
11. G. Cormode, S. Muthukrishnan, What's new: finding significant differences in network data streams, in: Proceedings of the IEEE Infocom, 2004.
12. C. Estan, G. Varghese, New directions in traffic measurement and accounting, in: Proceedings of the ACM SIGCOMM, 2002.
13. H. Wang, D. Zhang, K.G. Shin, Detecting SYN flooding attacks, in: Proceedings of the IEEE INFOCOM, 2002.
14. Wang H., Zhang D., and Shin K.G. Change-point monitoring for detection of DoS attacks. IEEE Transactions on Dependable and Secure Computing 1 4 (2004)
15. Checkpoint Software Technologies, TCP Flooding Attack and Firewall-1 SYNDefender. .
16. Cisco Inc., Per-Packet Load Balancing, 2003. .
17. Cisco Inc., Load balancing with Cisco Express Forwarding, 2003. .
18. Y. Gao, Z. Li, Y. Chen, A dos resilient flow-level intrusion detection approach for high-speed networks, in: The International Conference on Distributed Computing Systems, 2006.
19. R. Schweller, A. Gupta, E. Parsons, Y. Chen, Reversible sketches for efficient and accurate change detection over network data streams, in: ACM SIGCOMM/USENIX Internet Measurement Conference (IMC), 2004.
20. R. Schweller, Z. Li, Y. Chen, Y. Gao, A. Gupta, Y. Zhang, P. Dinda, M. Kao, G. Memik, Reverse hashing for high-speed network monitoring: Algorithms, evaluation, and applications, in: Proceedings of the IEEE Infocom, 2006.
21. J. Jung, V. Paxson, A. Berger, H. Balakrishnan, Fast portscan detection using sequential hypothesis testing, in: Proceedings of the IEEE Symposium on Security and Privacy, 2004.
22. N. Weaver, S. Staniford, V. Paxson, Very fast containment of scanning worms, in: USENIX Security Symposium, 2004.
23. Arbor Networks, Intelligent Network Management with Peakflow Traffic. .
24. Symantec Inc., Symantec ManHunt, .
25. N. Duffield, C. Lund, M. Thorup, Properties and prediction of flow statistics from sampled packet streams, in: Proceedings of the ACM SIGCOMM Internet Measurement Workshop (IMW), 2002.
26. N. Duffield, C. Lund, M. Thorup, Flow sampling under hard resource constraints, in: Proceedings of the ACM SIGMETRICS, 2004.
27. Wagner A., Dubendorfer T., Hiestand C.G.R., and Plattner B. A fast worm scan detection tool for vpn congestion avoidance. Lecture Notes in Computer Science (2006) 4064-4181
28. P. Gross, J. Parekh, G. Kaiser, Secure Selecticast for collaborative intrusion detection systems, in: Workshop on Distributed Event-Based System, 2002.
29. D. Moore, G.M. Voelker, S. Savage, Inferring Internet denial of service activity, in: Proceedings of the 2001 USENIX Security Symposium, 2001.
30. P. Barford, J. Kline, D. Plonka, A. Ron, A signal analysis of network traffic anomalies, in: ACM SIGCOMM IMC, 2002.
31. K. Keys, D. Moore, C. Estan, Robust system for accurate real-time summaries of internet traffic, in: Proceedings of the ACM SIGMETRICS, 2005.
32. Q.G. Zhao, A. Kumar, J.J. Xu, Joint data streaming and sampling techniques for detection of super sources and destinations, in: Proceedings of the ACM/USENIX Internet Measurement Conference, 2005.
33. G.S. Manku, R. Motwani, Approximate frequency counts over data streams, in: Proceedings of the International Conference on Very Large Data Bases VLDB, 2002.
34. G. Cormode, F. Korn, S. Muthukrishnan, D. Srivastava, Finding hierarchical heavy hitters in data streams, in: International Conference on Very Large Data Bases VLDB, 2003.
35. G. Cormode, F. Korn, S. Muthukrishnan, T. Johnson, O. Spatscheck, D. Srivastava, Holistic UDAFs at streaming speeds, in: Proceedings of the ACM SIGMOD, 2004.
36. S. Venkataraman, D. Song, P. Gibbons, A. Blum, New streaming algorithms for superspreader detection, in: the Annual Network and Distributed System Security Symposium (NDSS), 2005.
37. R.R. Kompella, S. Singh, G. Varghese, On scalable attack detection in the network, in: Proceedings of the ACM SIGCOMM/USENIX Internet Measurement Conference (IMC), 2004.
38. C.D. Anukool Lakhina, Mark Crovella, Mining anomalies using traffic feature distributions, in: Proceedings of the ACM SIGCOMM, 2005.
39. M.F. Thomas Karagiannis, Dina Papagiannaki, Blinc: multilevel traffic classification in the dark, in: Proceedings of the ACM SIGCOMM, 2005.
40. S.B. Kuai Xu, Zhi-Li Zhang, Profiling internet backbone traffic: behavior models and applications, in: Proceedings of the ACM SIGCOMM, 2005.
41. A.C. Gilbert, S. Guha, P. Indyk, S. Muthukrishnan, M.J. Strauss, QuickSAND: quick summary and analysis of network data, Tech. Rep., DIMACS Technical Report 2001-43, 2001.
42. B. Krishnamurthy, S. Sen, Y. Zhang, Y. Chen, Sketch-based change detection: methods, evaluation, and applications, in: Proceedings of the ACM SIGCOMM/USENIX Internet Measurement Conference (IMC), 2003.
43. M. Charikar, K. Chen, M. Farach-Colton, Finding frequent items in data streams, in: Proceedings of the 29th International Colloquium on Automata Languages and Programming, 2002.
44. M. Thorup, Y. Zhang, Tabulation based 4-universal hashing with applications to second moment estimation, in: Proceedings of the ACM-SIAM Symposium on Discrete Algorithms (SODA '04), 2004.
45. J.D. Brutlag, Aberrant behavior detection in time series for network service monitoring, in: Proceedings of the USNEIX Systems Administration Conference (LISA), 2000.
46. CERT Coordination Center, Current scanning activity, 2004. .
47. M. Rajab, J. Zarfoss, F. Monrose, A. Terzis, A multifaceted approach to understanding the botnet phenomenon, in: Proceedings of the ACM IMC, 2006.
48. V. Yegneswaran, P. Barford, J. Ullrich, Internet intrusions: global characteristics and prevalence, in: Proceedings of the ACM SIGMETRICS, 2003.
49. Staniford S., Hoagland J.A., and McAlerney J.M. Practical automated detection of stealthy portscans. Journal of Computer Security 10 1-2 (2002)
50. Insecure.org, Idle scanning and related ipid games, 2004. .
51. D. Bernstein, SYN Cookies. .
52. J. Jung, B. Krishnamurthy, M. Rabinovich, Flash crowds and denial of service attacks: Characterization and implications for CDNs and web sites, in: Proceedings of the Eleventh International World Wide Web Conference, 2002.
53. S. Institute, Dshield.org: Distributed intrusion detection system. .