Improving the performance of intrusion detection using dialog-based payload aggregation

2011 IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS 2011

Volumn , Issue , 2011, Pages 822-827

  Limmer, Tobias ^a   Dressler, Falko ^a  

^a UNIVERSITY OF ERLANGEN NUREMBERG   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

APPLICATION LAYER PROTOCOLS; BI-DIRECTIONAL COMMUNICATION; COMMODITY HARDWARE; DATA RATES; DATA STREAM; DETECTION PERFORMANCE; DIRECTION CHANGE; HIGH-SPEED; LINEAR RELATIONSHIPS; LIVE NETWORK TRAFFIC; NETWORK BASED INTRUSION DETECTION SYSTEMS; NETWORK TRAFFIC; PACKET PROCESSING; PAYLOAD DATA; PERFORMANCE ANALYSIS; PERFORMANCE PROBLEMS; PROCESSING TIME; SEQUENCE NUMBER; TCP CONNECTIONS; TCP/IP PACKET;

COMPUTER NETWORKS; DATA COMMUNICATION SYSTEMS; DATA HANDLING; DATA MINING; SEMANTICS; TRANSMISSION CONTROL PROTOCOL;

INTRUSION DETECTION;

EID: 79960605388     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOMW.2011.5928926     Document Type: Conference Paper

References (16)

1. M. Roesch, "Snort: Lightweight Intrusion Detection for Networks," in 13th USENIX Conference on System Administration (LISA 1999), Seattle, WA, November 1999, pp. 229-238.
2. V. Paxson, "Bro: A System for Detecting Network Intruders in Real-Time," Elsevier Computer Networks, vol. 31, no. 23-24, pp. 2435-2463, December 1999.
3. M. Handley, V. Paxson, and C. Kreibich, "Network intrusion detection: evasion, traffic normalization, and end-to-end protocol semantics," in 10th USENIX Security Symposium, Washington, DC, August 2001.
4. H. Dreger, A. Feldmann, V. Paxson, and R. Sommer, "Operational experiences with high-volume network intrusion detection," in 11th ACM Conference on Computer and Communications Security (ACM CCS 2004). Washington, DC: ACM, October 2004, pp. 2-11.
5. B. Claise, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information," IETF, RFC 5101, January 2008.
6. K. Namjoshi and G. Narlikar, "Robust and Fast Pattern Matching for Intrusion Detection," in 29th IEEE Conference on Computer Communications (INFOCOM 2010). San Diego, CA: IEEE, March 2010.
7. R. Smith, C. Estan, S. Jha, and S. Kong, "Deflating the Big Bang: Fast and Scalable Deep Packet Inspection with Extended Finite Automata," in ACM SIGCOMM 2008, Seattle, WA, August 2008, pp. 207-218.
8. G. Vasiliadis, M. Polychronakis, S. Antonatos, E. P. Markatos, and S. Ioannidis, "Regular Expression Matching on Graphics Hardware for Intrusion Detection," in 12th International Symposium on Recent Advances in Intrusion Detection (RAID 2009), vol. 5758, Saint-Malo, France, September 2009.
9. P. Tune and D. Veitch, "Towards Optimal Sampling for Flow Size Estimation," in 8th ACM SIGCOMM Conference on Internet Measurement (IMC 2008). Vouliagmeni, Greece: ACM, October 2008, pp. 243-256.
10. S. Kornexl, V. Paxson, H. Dreger, R. Sommer, and A. Feldmann, "Building a Time Machine for Efficient Recording and Retrieval of High-Volume Network Traffic," in 5th ACM SIGCOMM Conference on Internet Measurement (IMC 2005). Berkeley, CA: ACM, October 2005, pp. 267-272.
11. T. Limmer and F. Dressler, "Flow-based Front Payload Aggregation," in 34th IEEE Conference on Local Computer Networks (LCN 2009): 4th IEEE LCN Workshop on Network Measurements (WNM 2009). Zurich, Switzerland: IEEE, October 2009, pp. 1102-1109.
12. R. T. Lampert, C. Sommer, G. Münz, and F. Dressler, "Vermont - A Versatile Monitoring Toolkit for IPFIX and PSAMP," in IEEE/IST Workshop on Monitoring, Attack Detection and Mitigation (MonAM 2006). Tübingen, Germany: IEEE, September 2006, pp. 62-65.
13. T. Limmer and F. Dressler, "Dialog-based Payload Aggregation for Intrusion Detection," in 17th ACM Conference on Computer and Communications Security (CCS 2010), Poster Session. Chicago, IL: ACM, October 2010, pp. 708-710.
14. G. Maier, A. Feldmann, V. Paxson, and M. Allman, "On Dominant Characteristics of Residential Broadband Internet Traffic," in 9th ACM SIGCOMM Conference on Internet Measurement (IMC 2009). Chicago, IL: ACM, November 2009, pp. 90-102.
15. R. Sommer and V. Paxson, "Enhancing byte-level network intrusion detection signatures with context," in 10th ACM Conference on Computer and Communications Security (ACM CCS 2003). Washington, DC: ACM, October 2003, pp. 262-271.
16. L. Deri, "Improving passive packet capture: beyond device polling," in 4th International System Administration and Network Engineering Conference (SANE 2004), Amsterdam, The Netherlands, September 2004.