Empirical study of a national-scale distributed intrusion detection system: Backbone-level filtering of HTML responses in China

Proceedings - International Conference on Distributed Computing Systems

Volumn , Issue , 2010, Pages 315-326

  Park, Jong Chun ^a   Crandall, Jedidiah R ^a  

^a University of New Mexico   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DISTRIBUTED INTRUSION DETECTION SYSTEMS; EMPIRICAL STUDIES; FILTERING SYSTEMS; INTERNET CENSORSHIP; INTRUSION DETECTION SYSTEMS; IP ADDRESSS; MEASUREMENT RESULTS; POTENTIAL SOURCES; SCALE FILTER; SHEDDING LIGHT; STRING MATCHING; TRAFFIC ENGINEERING; TRAFFIC LOADS;

COMPUTER CRIME; HTML; INFORMATION RETRIEVAL SYSTEMS; INTERNET PROTOCOLS; TRANSMISSION CONTROL PROTOCOL; UNCERTAINTY ANALYSIS;

INTRUSION DETECTION;

EID: 77955877109     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICDCS.2010.46     Document Type: Conference Paper

References (35)

1. L. Lamport, "Time, Clocks, and the Ordering of Events in a Distributed System," Communications of the ACM, vol. 21, no. 7, pp. 558-565, July 1978.
2. T. H. Ptacek and T. N. Newsham, "Insertion, evasion, and denial of service: Eluding network intrusion detection," Secure Networks, Inc., Suite 330, 1201 5th Street S.W, Calgary, Alberta, Canada, T2R-0Y6, Tech. Rep., 1998. [Online]. Available: citeseer.ist.psu.edu/ptacek98insertion.html
3. V. Paxson, "Bro: a system for detecting network intruders in real-time," in SSYM'98: Proceedings of the 7th conference on USENIX Security Symposium, 1998. Berkeley, CA, USA: USENIX Association, 1998, pp. 3-3.
4. U. Shankar and V. Paxson, "Active mapping: Resisting nids evasion without altering traffic," in SP '03: Proceedings of the 2003 IEEE Symposium on Security and Privacy. Washington, DC, USA: IEEE Computer Society, 2003, p. 44.
5. S. Wolfgarten, "Investigating large-scale Internet content filtering," M.Sc. in Security and Forensic Computing 2005/2006, Dublin City University, Ireland.
6. Mr. Tao, "China: Journey to the heart of Internet censorship," Investigative report sponsored nu Reporters Without Borders and Chinese Human Rights Defenders, Oct 2007.
7. "The Great Firewall Revealed," Whitepaper released by the Global Internet Freedom Consortium in December of 2002.
8. R. Clayton, S. J. Murdoch, and R. N. M. Watson, "Ignoring the great firewall of china," I/S: A Journal of Law and Policy for the Information Society, vol. 3, no. 2, pp. 70-77, 2007.
9. -, "Ignoring the Great Firewall of China," in 6th Workshop on Privacy Enhancing Technologies, 2006. [Online]. Available: http://www. petworkshop.org/2006/program.html
10. J. R. Crandall, D. Zinn, M. Byrd, E. Barr, and R. East, "ConceptDoppler: a weather tracker for Internet censorship," in Proc. of 14th ACM Conference on Computer and Communications Security (CCS), 2007.
11. The Open Net Initiative (http://opennet.net), "China (including Hong Kong)," Country profile.
12. J. Zittrain and B. Edelman, "Internet filtering in China," IEEE Internet Computing, vol. 7, no. 2, pp. 70-77, 2003.
13. J. Fallows, "The Connection Has Been Reset," Atlantic Monthly, March 2008.
14. V. Paxson, "End-to-end routing behavior in the Internet," in SIGCOMM '96, 1996.
15. "Scapy (Home Page)," http://www.secdev.org/projects/scapy/.
16. "Fragroute (Home Page)," http://www.monkey.org/~dugsong/ fragroute/.
17. G. Ziemba, D. Reed, and P. Traina, "Security Considerations for IP Fragment Filtering," RFC 1858 (Informational), Oct. 1995, updated by RFC 3128. [Online]. Available: http://www.ietf.org/rfc/rfc1858.txt
18. I. Miller, "Protection Against a Variant of the Tiny Fragment Attack (RFC 1858)," RFC 3128 (Informational), Jun. 2001. [Online]. Available: http://www.ietf.org/rfc/rfc3128.txt
19. M. Arlitt and C. Williamson, "An analysis of tcp reset behaviour on the internet," SIGCOMM Comput. Commun. Rev., vol. 35, no. 1, pp. 37-44, 2005.
20. N. Weaver, R. Sommer, and V. Paxson, "Detecting forged TCP reset packets," in Proceedings of the Network and Distributed System Security Symposium, NDSS 2009, San Diego, California, USA. The Internet Society, 2009.
21. R. J. Deibert, J. G. Palfrey, R. Rohozinski, and J. Zittrain, "Access denied: The practice and policy of global internet filtering," The MIT Press, 2007.
22. N. Villeneuve, "Breaching trust: An analysis of surveillance and security practices on China's TOM-Skype platform," Available at http://www. infowar-monitor.net/breachingtrust/.
23. R. Clayton, "Failures in a hybrid content blocking system." in Privacy Enhancing Technologies, 2005, pp. 78-92.
24. M. Dornseif, "Government mandated blocking of foreign web content," in Security, E-Learning, E-Services: Proceedings of the 17. DFN-Arbeitstagung über Kommunikationsnetze, ser. Lecture Notes in Informatics, J. von Knop, W. Haverkamp, and E. Jessen, Eds., 2003, pp. 617-648. [Online]. Available: citeseer.ist.psu.edu/dornseif03government.html
25. G. Danezis and R. Anderson, "The economics of resisting censorship," IEEE Security and Privacy, vol. 3, no. 1, pp. 45-50, 2005.
26. J. Aycock and A. Maurushat, ""good" worms and human rights," SIGCAS Comput. Soc., vol. 38, no. 1, pp. 28-39, 2008.
27. J. D. Tygar, "Technological dimensions of privacy in Asia," Asia-Pacific Review, Volume 10, Issue 2, November 2003, pages 120-145.
28. ""Race to the Bottom": Corporate Complicity in Chinese Internet Censorship," in Human Rights Watch, August 2006, http://www.hrw. org/reports/2006/china0806.
29. C. Liang, "Red light, green light: has China achieved its goals through the 2000 Internet regulations?" Vanderbilt Journal of Transnational Law, vol. 345, 2001.
30. M. S. Chase and J. C. Mulvenon, You've Got Dissent! Chinese Dissident Use of the Internet and Beijing's Counter-Strategies. RAND Corporation, 2002.
31. R. Dingledine, N. Mathewson, and P. Syverson, "Tor: The secondgeneration onion router," 2004. [Online]. Available: citeseer.ist.psu.edu/ dingledine04tor.html
32. R. D. et al, "Psiphon," http://psiphon.civisec.org/.
33. Y. Sovran, A. Libonati, and J. Li, "Pass it on: Social networks stymie censors," in Proceedings of the 7th International Workshop on Peer-to- Peer Systems (IPTPS '08), Feb 2008, 2008.
34. N. Feamster, M. Balazinska, G. Harfst, H. Balakrishnan, and D. Karger, "Infranet: Circumventing Web Censorship and Surveillance," in 11th USENIX Security Symposium, San Francisco, CA, August 2002. [Online]. Available: http://wind.lcs.mit.edu/papers/
35. A. Fiat and J. Saia, "Censorship resistant peer-to-peer content addressable networks," in SODA '02: Proceedings of the thirteenth annual ACM-SIAM symposium on Discrete algorithms. Philadelphia, PA, USA: Society for Industrial and Applied Mathematics, 2002, pp. 94-103.