Packet sampling for worm and botnet detection in TCP connections

Proceedings of the 2010 IEEE/IFIP Network Operations and Management Symposium, NOMS 2010

Volumn , Issue , 2010, Pages 264-271

  Braun, Lothar ^a   Münz, Gerhard ^a   Carle, Georg ^a  

^a TECHNICAL UNIVERSITY OF MUNICH   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNET; LEARNING ALGORITHMS; MALWARE; TRANSMISSION CONTROL PROTOCOL;

ATTACK SIGNATURE; BOTNET DETECTIONS; COMPUTATIONAL RESOURCES; DETECTION SYSTEM; PACKET ANALYSIS; SAMPLING ALGORITHM; STATE INFORMATION; TCP CONNECTIONS;

NETWORK SECURITY;

EID: 77957764541     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NOMS.2010.5488473     Document Type: Conference Paper

References (25)

1. M. Roesch, "Snort - Lightweight Intrusion Detection for Networks," in Proc. of 13th USENIX Systems Administration Conference (LISA'99), Seattle, WA, USA, Nov. 1999.
2. S. Fide and S. Jenks, "A Survey of String Matching Approaches in Hardware," Dept. of Electrical Engineering and Computer Science, University of California, Irvine, Tech. Rep. TR SPDS 06-01, Mar. 2006.
3. M. Colajanni and M. Marchetti, "A Parallel Architecture for Stateful Intrusion Detection in High Traffic Networks," in Proc. of Workshop on Monitoring, Attack Detection and Mitigation (MonAM) 2006, Tübingen, Germany, Sep. 2006.
4. K. Wang and S. J. Stolfo, "Anomalous Payload-Based Network Intrusion Detection," in Proc. of International Symposium on Recent Advances In Intrusion Detection (RAID) 2004, Sophia Antipolis, France, Sep. 2004.
5. S. Kornexl, V. Paxson, H. Dreger, A. Feldmann, and R. Sommer, "Building a Time Machine for Efficient Recording and Retrieval of High-Volume Network Traffic," in Proc. of ACM SIGCOMM Internet Measurement Conference (IMC) 2005, Berkeley, CA, USA, Oct. 2005.
6. S. Dharmapurikar and V. Paxson, "Robust TCP Stream Reassembly in the Presence of Adversaries," in Proc. of the USENIX Security Symposium 2005, Baltimore, MD, USA, Jul. 2005.
7. G. Maier, R. Sommer, H. Dreger, A. Feldmann, V. Paxson, and F. Schneider, "Enriching Network Security Analysis with Time Travel," in Proc. of ACM SIGCOMM 2008 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, Seattle, WA, USA, Aug. 2008.
8. S. Sen, O. Spatscheck, and D. Wang, "Accurate, Scalable In-Network Identification of P2P Traffic Using Application Signatures," in Proc. of International Conference on World Wide Web, New York, NY, USA, May 2004.
9. Y. Won, B.-C. Park, H.-T. Ju, M.-S. Kim, and J. Hong, "A Hybrid Approach for Accurate Application Traffic Identification," in Proc. of IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services (E2EMon) 2006, Vancouver, BC, Canada.
10. B. H. Bloom, "Space/Time Trade-Offs in Hash Coding with Allowable Errors," Communications of the ACM, vol. 13, no. 7, 1970.
11. F. Chang, W. Feng, and K. Li, "Approximate Caches for Packet Classification," in Proc. of Conference of the IEEE Computer and Communications Societies (INFOCOM) 2004, Hong Kong, China, Mar. 2004.
12. S. Kong, T. He, X. Shao, and X. Li, "Time-out Bloom Filter: A New Sampling Method for Recording More Flows," in Proc. of International Conference on Information Networking (ICOIN) 2006, Sendai, Japan, Jan. 2006.
13. S. Kong, T. He, X. Shao, C. An, and X. Li, "A Double-Filter Structure Based Scheme for Scalable Port Scan Detection," in Proc. of IEEE International Conference on Communications (ICC) 2006, Istanbul, Turkey, Jun. 2006.
14. C. Estan, G. Varghese, and M. Fisk, "Bitmap Algorithms for Counting Active Flows on High Speed Links," in Proc. of ACM SIGCOMM Internet Measurement Conference (IMC) 2003, Miami Beach, Florida, USA, Oct. 2003.
15. J. Sanjuas-Cuxart, P. Barlet-Ros, and J. Sole-Pareta, "Counting Flows over Sliding Windows in High Speed Networks," in Proc. of IFIP Networking Conference. Aachen, Germany: Springer, May 2009.
16. A. Kumar, J. J. Xu, J. Wang, O. Spatschek, and L. E. Li, "SpaceCode Bloom Filter for Efficient Per-Flow Traffic Measurement," in Proc. of Conference of the IEEE Computer and Communications Societies (INFOCOM) 2004, Hong Kong, China, Mar. 2004.
17. A. Kumar and J. J. Xu, "Sketch Guided Sampling - Using OnLine Estimates of Flow Size for Adaptive Data Collection," in Proc. of Conference of the IEEE Computer and Communications Societies (INFOCOM) 2006, Barcelona, Spain, Apr. 2006.
18. A. Ramachandran, S. Seetharaman, N. Feamster, and V. Vazirani, "Fast Monitoring of Traffic Subpopulations," in Proc. of ACM SIGCOMM Internet Measurement Conference (IMC) 2008, Vouliagmeni, Greece, Oct. 2008.
19. G. Cormode, S. M. Muthukrishnan, and W. Zhuang, "Whats Different: Distributed, Continuous Monitoring of Duplicate-Resilient Aggregates on Data Streams," in Proc. of IEEE International Conference on Data Engineering (ICDE) 2006, Atlanta, Georgia, USA, Apr. 2006.
20. B. Whitehead, C-H. Lung, and P. Rabinovitch, "A TCP Connection Establishment Filter: Symmetric Connection Detection," in Proc. of IEEE International Conference on Communications (ICC) 2007, Glasgow, Scotland, Jun. 2007.
21. M. Canini, D. Fay, D. J. Miller, A. W. Moore, and R. Bolla, "Per Flow Packet Sampling for High-Speed Network Monitoring," in Proc. of International Conference on Communication Systems and Networks (COMSNETS) 2009, Bangalore, India, Jan. 2009.
22. Website of the project Emerging Threats, Internet: http://www. emergingthreats.net/.
23. G. Cormode and S. Muthukrishnan, "An Improved Data Stream Summary: The Count-Min Sketch and its Applications," Journal of Algorithms, vol. 55, no. 1, 2005.
24. J. L. Carter and M. N. Wegman, "Universal Classes of Hash Functions," Journal of Computer and System Science, vol. 18, no. 2, 1979.
25. Traffic repository Twente University, http://traces.simpleweb.org.