Network-wide deployment of intrusion detection and prevention systems

Proceedings of the 6th International Conference on Emerging Networking Experiments and Technologies, Co-NEXT'10

Volumn , Issue , 2010, Pages

  Sekar, Vyas ^a   Krishnaswamy, Ravishankar ^b   Gupta, Anupam ^b   Reiter, Michael K ^c  

^a INTEL CORPORATION   (United States)

^b CARNEGIE MELLON UNIVERSITY   (United States)

^c UNIVERSITY OF NORTH CAROLINA   (United States)

Author keywords

intrusion detection; network management

Indexed keywords

ALTERNATIVE DESIGNS; HARDWARE CONSTRAINTS; INTRUSION DETECTION AND PREVENTION SYSTEMS; INTRUSION PREVENTION SYSTEMS; LINEAR PROGRAMMING FORMULATION; NETWORK INTRUSION DETECTION; NP-HARD; OPTIMIZATION PROBLEMS; RANDOMIZED ROUNDING; SPECIALIZED HARDWARE; UNWANTED TRAFFIC;

APPROXIMATION ALGORITHMS; LINEAR PROGRAMMING; NETWORK MANAGEMENT; OPTIMIZATION;

INTRUSION DETECTION;

EID: 79951700744     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1921168.1921192     Document Type: Conference Paper

References (42)

1. S. Acharya, M. Abliz, B. Mills, T. F. Znati, J. Wang, Z. Ge, and A. Greenberg. OPTWALL: A Traffic-Aware Hierarchical Firewall Optimization. In Proc. NDSS, 2007.
2. D. L. Applegate, G. Calinescu, D. S. Johnson, H. Karloff, K. Ligett, and J. Wang. Compressing Rectilinear Pictures and Minimizing Access Control Lists. In Proc. SODA, 2007.
3. Arbor networks. http://www.arbor.com.
4. AT&T Enterprise Threat Management. http://www.business.att.com/ enterprise/Family/business-continuity-enterprise/threat-management-enterprise/.
5. H. Ballani and P. Francis. CONMan: A Step Towards Network Manageability. In Proc. ACM SIGCOMM, 2007.
6. C. Kruegel, F. Valeur, G. Vigna, and R. A. Kemmerer. Stateful Intrusion Detection for High-Speed Networks. In Proc. IEEE Symposium on Security and Privacy, 2002.
7. M. Caesar, D. Caldwell, N. Feamster, J. Rexford, A. Shaikh, and J. van der Merwe. Design and implementation of a Routing Control Platform. In Proc. NSDI, 2005.
8. G. R. Cantieni, G. Iannaccone, C. Barakat, C. Diot, and P. Thiran. Reformulating the Monitor Placement problem: Optimal Network-Wide Sampling. In Proc. CoNeXT, 2006.
9. N. Duffield and M. Grossglauser. Trajectory Sampling for Direct Traffic Observation. In Proc. ACM SIGCOMM, 2001.
10. E. W. Fulp. Optimization of network firewalls policies using directed acyclic graphs. In Proc. Internet Management Conference, 2005.
11. F. Cuppens and A. Miege. Alert correlation in a cooperative intrusion detection framework. In Proc. IEEE Symposium on Security and Privacy, 2002.
12. A. Feldmann, A. G. Greenberg, C. Lund, N. Reingold, J. Rexford, and F. True. Deriving Traffic Demands for Operational IP Networks: Methodology and Experience. In Proc. ACM SIGCOMM, 2000.
13. L. Foschini, A. V. Thapliyal, L. Cavallaro, C. Kruegel, and G. Vigna. A Parallel Architecture for Stateful, High-Speed Intrusion Detection. In Proc. ICISS, 2008.
14. A. Greenberg, G. Hjalmtysson, D. A. Maltz, A. Meyers, J. Rexford, G. Xie, H. Yan, J. Zhan, and H. Zhang. A Clean Slate 4D Approach to Network Control and Management. ACM SIGCOMM CCR, 35(5), Oct. 2005.
15. H. Dreger, A. Feldmann, V. Paxson, and R. Sommer. Operational Experiences with High-Volume Network Intrusion Detection. In Proc. ACM CCS, 2004.
16. H. Dreger, A. Feldmann, V. Paxson and R. Sommer. Predicting the Resource Consumption of Network Intrusion Detection Systems. In Proc. RAID, 2008.
17. J. Gonzalez, V. Paxson, and N. Weaver. Shunting: A Hardware/Software Architecture for Flexible, High-Performance Network Intrusion Prevention. In Proc. ACM CCS, 2007.
18. A. Kalai and S. Vempala. Efficient Algorithms for Online Decision Problems. Journal of Computer System Sciences, 71(3), Oct. 2005.
19. A. Lakhina, M. Crovella, and C. Diot. Mining anomalies using traffic feature distributions. In Proc. ACM SIGCOMM, 2005.
20. V. T. Lam, M. Mitzenmacher, and G. Varghese. Carousel: Scalable Logging for Intrusion Prevention Systems. In Proc. NSDI, 2010.
21. A. Le, E. Al-Shaer, and R. Batouba. Correlation-Based Load Balancing for Intrusion Detection and Prevention Systems. In Proc. SECURECOMM, 2008.
22. X. Li, F. Bian, H. Zhang, C. Diot, R. Govindan, W. Hong, and G. Iannaccone. MIND: A Distributed Multidimensional Indexing for Network Diagnosis. In Proc. IEEE INFOCOM, 2006.
23. K. Ligett, S. Kakade, and A. T. Kalai. Playing Games with Approximation Algorithms. In Proc. STOC, 2007.
24. M. Kodialam, T. V. Lakshman, and Sudipta Sengupta. Configuring Networks with Content Filtering Nodes with Applications to Network Security. In Proc. INFOCOM, 2005.
25. R. Mahajan, N. Spring, D. Wetherall, and T. Anderson. Inferring Link Weights using End-to-End Measurements. In Proc. IMW, 2002.
26. M. Molina, S. Niccolini, and N. Duffield. A Comparative Experimental Study of Hash Functions Applied to Packet Sampling. In Proc. International Teletraffic Congress (ITC), 2005.
27. S. Narain, G. Levin, S. Malik, and V. Kaul. Declarative infrastructure configuration synthesis and debugging. Journal of Network and Systems Management, 16(3), 2008.
28. V. Paxson. Bro: A System for Detecting Network Intruders in Real-Time. Computer Networks, 31(23-24):2435-2463, 1999.
29. P. Raghavan and C. D. Thompson. Randomized rounding: A technique for provably good algorithms and algorithmic proofs. Combinatorica, 7(4), Dec. 1987.
30. M. Roughan, M. Thorup, and Y. Zhang. Performance of estimated traffic matrices in traffic engineering. In SIGMETRICS, 2003.
31. V. Sekar, R. Krishnaswamy, A. Gupta, and M. K. Reiter. Network-Wide Deployment of Intrusion Detection and Prevention Systems. Technical Report, CMU-CS-10-124, Comp. Sci. Dept., CMU, 2010.
32. V. Sekar, M. K. Reiter,W. Willinger, H. Zhang, R. Kompella, and D. G. Andersen. cSamp: A System for Network-Wide Flow Monitoring. In Proc. NSDI, 2008.
33. M. R. Sharma and J. W. Byers. Scalable Coordination Techniques for Distributed Network Monitoring. In Proc. PAM, 2005.
34. R. Sommer and V. Paxson. Exploiting Independent State for Network Intrusion Detection. In Proc. ACSAC, 2005.
35. R. Sommer, V. Paxson, and N. Weaver. An Architecture for Exploiting Multi-Core Processors to Parallelize Network Intrusion Prevention. Concurrency and Computation: Practice and Experience, Wiley, 21(10):1255-1279, 2009.
36. N. Spring, R. Mahajan, and D. Wetherall. Measuring ISP Topologies with Rocketfuel. In Proc. ACM SIGCOMM, 2002.
37. K. Suh, Y. Guo, J. Kurose, and D. Towsley. Locating Network Monitors: Complexity, heuristics and coverage. In Proc. IEEE INFOCOM, 2005.
38. M. Vallentin, R. Sommer, J. Lee, C. Leres, V. Paxson, and B. Tierney. The NIDS Cluster: Scalable, Stateful Network Intrusion Detection on Commodity Hardware. In Proc. RAID, 2007.
39. F. Yu, R. H. Katz, and T. V. Lakshman. Gigabit Rate Packet Pattern-Matching Using TCAM. In Proc. ICNP, 2004.
40. F. Yu, T. V. Lakshman, M. A. Motoyama, and R. H. Katz. SSA: A Power and Memory Efficient Scheme to Multi-Match Packet Classification. In Proc. ANCS, 2005.
41. Y. Zhang, N. Duffield, V. Paxson, and S. Shenker. On the Constancy of Internet Path Properties. In Proc. IMW, 2001.
42. Y. Zhang, M. Roughan, N. Duffield, and A. Greenberg. Fast Accurate Computation of Large-scale IP Traffic Matrices from Link Loads. In Proc. ACM SIGMETRICS, 2003.