Detection of attackers in services using anomalous host behavior based on traffic flow statistics

Proceedings - 11th IEEE/IPSJ International Symposium on Applications and the Internet, SAINT 2011

Volumn , Issue , 2011, Pages 353-359

  Sawaya, Yukiko ^a   Kubota, Ayumu ^a   Miyake, Yutaka ^a  

^a KDDI R AND D LABORATORIES INC   (Japan)

Author keywords

botnet; DDoS attack; flow based attacker detection; NetFlow; spam mail sending hosts

Indexed keywords

BOTNET; COMPUTING RESOURCE; DDOS ATTACK; DEEP PACKET INSPECTION; DETECTION METHODS; FLOW DATA; GLOBAL NETWORKS; HIGH DETECTION RATE; HOST BEHAVIORS; MALICIOUS HOST; NETFLOWS; SPAM MAILS; TCP PORTS; TRAFFIC FLOW;

INTERNET; TELECOMMUNICATION NETWORKS;

COMPUTER NETWORK PERFORMANCE EVALUATION;

EID: 80053022689     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SAINT.2011.68     Document Type: Conference Paper

References (24)

1. H. Esquivel, T. Mori, A. Akella, "Router Level Spam Filtering Using TCP Fingerprints: Architecture and Measurement Based Evaluation,"in Proc. of Sixth Conference on Email and Anti-Spam, Mountain View, CA, USA
2. J. J. Flores, A. Antolino, J. M. Garcia, "Evolving HMMs For Network Anomaly Detection - Learning Through Evolutionary Computation,"in Proc. of Sixth International Conference on Networking and Services, 2010, pp. 271-276.
3. T. Limmer, F. Dressler, "Dialog-based Payload Aggregation for Intrusion Detection," Proceedings of the 17th ACM conference on Computer and communications security, Chicago, Illinois, USA, Oct. 2010.
4. G. Miinz, G. Carle, "Real-time Analysis of Flow Data for Network Attack Detection," in Proc. of 10th IFIP/IEEE International Symposium on Integrated Network Management, 2007, pp. 100-108.
5. Lakhina, M. Crovella, and C. Diot, "Characterization of Network-Wide Anomalies in Traffic Flows," in Proc. of 4th ACM SIGCOMM Conference on Internet Measurement. Taormina, Sicily, Italy: ACMPress, Oct. 2004, pp. 201-206.
6. Lakhina, M. Crovella, and C. Diot, "Mining Anomalies Using Traffic Feature Distributions," in Proc. of ACM SIGCOMM Conference, Philadelphia, PA, USA, Aug. 2005, pp. 217-228.
7. J. Terrell, K. Jeffay, F. D. Smith, L. Zhang, H. Shen, Z. Zhu, and A. Nobel, "Multivariate SVD Analyses For Network Anomaly Detection," in Proc. of ACM SIGCOMM Conference, Poster Session, Philadelphia, PA,USA, Aug. 2005.
8. W. Wang, W. Wu, "Online Detection of Network Traffic Anomalies Using Degree Distributions," Int. J. Communications, Network and System Sciences, 2010, Vol. 3, pp. 177-182.
9. L. Feinstein, D. Schnackenberg, R. Balupari, D. Kindred, "Statistical Approaches to DDoS Attack Detection and Response," Proceedings of the DARPA Information Survivability Conference and Exposition, Washington, DC, USA, 2003, vol. 1, pp. 303.
10. W. K. Ehrlich, "Detection of Spam Hosts and Spam Bots Using Network Flow Traffic Modeling," in Proc. of 3rd USENIX workshop on Large-Scale Exploits and Emergent Threats, San Jose, 2010.
11. "RFC3954: Cisco Systems NetFlow Services Export Version 9,"http://tools.ietf.org/html/rfc3954
12. "RFC3176: InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks,"http://tools.ietf.org/html/rfc3176
13. "Blaster Worm TFTP Backdoor (UDP): Attack Signature - Symantec Corp.,"http://www.symantec.com/business/security-response/attacksignatures/ detail.jsp?asid=20098
14. "W32.Zotob.E | Symantec,"http://www.symantec.com/security- response/writeup.jsp?docid=2005-081615-4443-99
15. "Correlation,"http://www.sjsu.edu/faculty/gerstman/StatPrimer/ correlation.pdf
16. "UCEPROTECT®-Network - Germanys first Spam protection database," http://www.uceprotect.net/en/index.php
17. "The Spamhaus Project," http://www.spamhaus.org/
18. "BarracudaCentral.org - Technical Insight for Security Pros, "http://www.barracudacentral.org/
19. "DNSBL, RBL, SURBL, DNSWL Services, FREE Real Time Black & White List Services, RBL, DNSBL, SURBL, DNSWL, Spam Protection, Junk Email Filter, nsZones.com," http://nszones.com/
20. "Passive Spam Block List," http://psbl.surriel.com/
21. "no-more-funn: dr. Joslash;rgen Mash's dnsbl,"http://www. moensted.dk/spam/no-more-funn/
22. "SORBS (Spam and Open-Relay Blocking System),"http://www.au. sorbs.net/
23. "SpamCannibal," http://www.spamcannibal.org/cannibal.cgi
24. H. Husna, S. Phithakkitnukoon, S. Palla, R. Dantu, "Behavior analysis of spam botnets," in Proc. of the third International Conference on communication system software and middleware, 2008, Bangalore, India, pp. 246-253