Localization attacks to internet threat monitors: Modeling and countermeasures

IEEE Transactions on Computers

Volumn 59, Issue 12, 2010, Pages 1655-1668

  Yu, Wei ^a   Zhang, Nan ^b   Fu, Xinwen ^c   Bettati, Riccardo ^d   Zhao, Wei ^e  

^a TOWSON UNIVERSITY   (United States)

^b The George Washington University   (United States)

^c University of Massachusetts Lowell   (United States)

^d TEXAS A AND M UNIVERSITY   (United States)

^e UNIVERSITY OF MACAU   (Macao)

Author keywords

defense; Internet threat monitoring systems; localization attack; modeling

Indexed keywords

INFORMATION THEORY; MODELS; MONITORING; NETWORK SECURITY;

ATTACK DETECTION; DEFENSE; DETECTION APPROACH; DISTRIBUTED DENIAL OF SERVICE ATTACK; LOCALIZATION ATTACK; MONITORING SYSTEM; THEORETIC MODEL;

DENIAL-OF-SERVICE ATTACK;

EID: 78149241149     PISSN: 00189340     EISSN: None     Source Type: Journal    
DOI: 10.1109/TC.2010.88     Document Type: Article

References (36)

1. D. Moore, C. Shannon, and J. Brown, "Code-Red: A Case Study on the Spread and Victims of an Internet Worm", Proc. Second Internet Measurement Workshop (IMW), Nov. 2002.
2. J. Mirkovic and P. Reiher, "A Taxonomy of DDOS Attack and DDOS Defense Mechanisms", ACM SIGCOMM Computer Comm. Rev., vol. 34, no. 2, pp. 39-53, Apr. 2004.
3. Internet Security News, http://www.landfield.com/isn/mailarchive/2001/ Feb/0037.html, 2008.
4. SANS, Internet Storm Center, http://isc.sans.org/, 2010.
5. V. Yegneswaran, P. Barford, and D. Plonka, "On the Design and Utility of Internet Sinks for Network Abuse Monitoring", Proc. Symp. Recent Advances in Intrusion Detection (RAID), Sept. 2003.
6. D. Moore, "Network Telescopes: Observing Small or Distant Security Events", Proc. Invited Presentation at the 11th USENIX Security Symp. (SEC), Aug. 2002.
7. D. Moore, G. M. Voelker, and S. Savage, "Inferring Internet Deny-of-Service Activity", Proc. 10th USNIX Security Symp. (SEC), Aug. 2001.
8. V. Yegneswaran, P. Barford, and S. Jha, "Global Intrusion Detection in the Domino Overlay System", Proc. 11th IEEE Network and Distributed System Security Symp. (NDSS), Feb. 2004.
9. M. Bailey, E. Cooke, F. Jahanian, J. Nazario, and D. Watson, "The Internet Motion Sensor: A Distributed Blackhole Monitoring System", Proc. 12th Ann. Network and Distributed System Security Symp. (NDSS), Feb. 2005.
10. J. Bethencourt, J. Frankin, and M. Vernon, "Mapping Internet Sensors with Probe Response Attacks", Proc. 14th USNIX Security Symp. (SEC), July/Aug. 2005.
11. Y. Shinoda, K. Ikai, and M. Itoh, "Vulnerabilities of Passive Internet Threat Monitors", Proc. 14th USNIX Security Symp. (SEC), July/Aug. 2005.
12. X. Wang, W. Yu, X. Fu, D. Xuan, and W. Zhao, "Iloc: An Invisible Localization Attack to Internet Threat Monitoring Systems", Proc. IEEE INFOCOM (Mini-Conf.), Apr. 2008.
13. S. Cabuk, C. Brodley, and C. Shields, "Ip Covert Timing Channels: Design and Detection", Proc. 2004 ACM Conf. Computer and Comm. Security (CCS), Oct. 2004.
14. J. Twucrpss and M. M. Williamson, "Implementing and Testing a Virus Throttling", Proc. 12th USENIX Security Symp. (SEC), Aug. 2003.
15. V. Sekar, Y. Xie, D. Maltz, M. Reiter, and H. Zhang, "Toward a Framework for Internet Forensic Analysis", Proc. Third Workshop Hot Topics in Networks (HotNets), Nov. 2004.
16. E. Cooke, F. Jahanian, and D. McPherson, "The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets", Proc. Steps to Reducing Unwanted Traffic on the Internet Workshop (SRUTI), July 2005.
17. F. C. Freiling, T. Holz, and G. Wicherski, "Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks", Proc. 10th European Symp. Research in Computer Security (ESORICS), Sept. 2005.
18. R. K. Pickholtz, D. L. Schilling, and L. B. Milstein, "Theory of Spread-Spectrum Communication: Tutorial", IEEE Trans. Comm., vol. 30, no. 5, pp. 855-884, May 1982.
19. C. E. Shannon, The Mathematical Theory of Communication. Univ. of Illinois Press, 1949.
20. T. M. Cover and J. A. Thomas, Elements of Information Theory. John Wiley & Sons, Inc., 1991.
21. M. S. Gast, 802.11 Wireless Networks: The Definitive Guide, first ed. O'Reilly & Assoc., Inc., 2002.
22. D. Tse and P. Viswanath, Fundamentals of Wireless Communication. Cambridge Univ. Press, 2005.
23. T. Lane and C. E. Brodley, "Temporal Sequence Learning and Data Reduction for Anomaly Detection", ACM Trans. Information and System Security, vol. 2, no. 3, pp. 295-331, Aug. 1999.
24. J. G. Proakis and M. Salehi, Fundamentals of Communication Systems. Prentice Hall, Dec. 2004.
25. K. Chellapilla, K. Larson, P. Simard, and M. Czerwinski, "Computers Beat Humans at Single Character Recognition in Reading Based Human Interaction Proofs (Hips)", Proc. Fifth Conf. Email and Anti-Spam (CEAS), Aug. 2008.
26. CAIDA, Telescope Analysis, http://www.caida.org/analysis/security/ telescope, 2010.
27. myNetWatchman, myNetWatchman Project, http://www.mynetwatchman.com, 2010.
28. N. Provos, "A Virtual Honeypot Framework", Proc. 12th USENIX Security Symp. (SEC), Aug. 2004.
29. P. Gross, J. Parekh, and G. Kaiser, "Secure Selecticast for Collaborative Intrusion Detection Systems", Proc. Third Int'l Workshop Distributed Event-Based Systems (DEBS), May 2004.
30. P. A. Porras and V. Shmatikov, "Large-Scale Collection and Sanitization of Network Security Data: Risks and Challenges", Proc. 2006 Workshop New Security Paradigms (NSPW), Sept. 2006.
31. R. Bohme and G. Kataria, "Models and Measures for Correlation in Cyber-Insurance", Proc. Fifth Workshop the Economics of Information Security (WEIS), June 2006.
32. C. Viecco and J. Camp, "A Risk Based Approach to Limit the Effects of Covert Channels for Internet Sensor Data Aggregators for Sensor Privacy", Proc. Third IFIP WG 11.11 Int'l Conf. Trust Management (TM), June 2009.
33. E. J. Crusellers, M. Soriano, and J. L. Melus, "Spreading Codes Generator for Wireless cdma Network", Int'l J. Wireless Personal Comm., vol. 7, no. 1, pp. 69-88, 1998.
34. G. Shah, A. Molina, and M. Blaze, "Keyboards and Covert Channels", Proc. 15th USENIX Security Symp., July/Aug. 2006.
35. D. Bailey, D. Boneh, E.-J. Goh, and A. Juels, "Covert Channels in Privacy-Preserving Identification Systems", Proc. 2007 ACM Conf. Computer and Comm. Security (CCS), Nov. 2007.
36. T. Takahashi and W. Lee, "An Assessment of voip Covert Channel Threats", Proc. IEEE Int'l Conf. Security and Privacy in Comm. Networks (SecureComm), Sept. 2007.