Tracking dynamic sources of malicious activity at Internet-scale

Advances in Neural Information Processing Systems 22 - Proceedings of the 2009 Conference

Volumn , Issue , 2009, Pages 1946-1954

  Venkataraman, Shobha ^a   Blum, Avrim ^b   Song, Dawn ^c   Sen, Subhabrata ^a   Spatscheck, Oliver ^a  

^a AT AND T LABS RESEARCH   (United States)

^b CARNEGIE MELLON UNIVERSITY   (United States)

^c UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ARTIFICIAL INTELLIGENCE;

ALGORITHM PERFORMANCE; DATA SET; HIGH-ACCURACY; MALICIOUS ACTIVITIES; NOVEL ALGORITHM; PAGING ALGORITHMS; REAL-WORLD; SPACE REQUIREMENTS; TARGET FUNCTIONS;

DECISION TREES;

EID: 84858728623     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (27)

1. Brightmail. http://www.brightmail.com.
2. SpamAssassin. http://www.spamassassin.apache.org.
3. SpamHaus. http://www.spamhaus.net.
4. BLUM, A., AND MANSOUR, Y. From external to internal regret. In In Proceedings of 18th Annual Conference on Computational Learning Theory (COLT 2005) (2005).
5. CESA-BIANCHI, N., FREUND, Y., HAUSSLER, D., HELMBOLD, D. P., SCHAPIRE, R. E., AND WAR-MUTH, M. K. How to use expert advice. J. ACM 44, 3 (1997), 427-485.
6. COLLINS, M. P., SHIMEALL, T. J., FABER, S., NAIES, J., WEAVER, R., AND SHON, M. D. Using uncleanliness to predict future botnet addresses. In Proceedings of the Internet Measurement Conference (2007).
7. CORMODE, G., KORN, F., MUTHUKRISHNAN, S., AND SRIVASTAVA, D. Diamond in the rough: Finding hierarchical heavy hitters in multi-dimensional data. In SIGMOD '04: Proceedings of the 2004 ACM SIGMOD international conference on Management of data (2004).
8. DOMINGOS, P., AND HULTEN, G. Mining high-speed data streams. In Proceedings of ACM SIGKDD (2000), pp. 71-80.
9. ESTAN, C., SAVAGE, S., AND VARGHESE, G. Automatically inferring patterns of resource consumption in network traffic. In Proceedings of SIGCOMM'03 (2003).
10. FREUND, Y., SCHAPIRE, R. E., SINGER, Y., AND WARMUTH, M. K. Using and combining predictors that specialize. In Proceedings of the Twenty-Ninth Annual Symposium on the Theory of Computing (STOC) (1997), pp. 334-343.
11. HELMBOLD, D. P., AND SCHAPIRE, R. E. Predicting nearly as well as the best pruning of a decision tree. Machine Learning 27, 1 (1997), 51-68.
12. HERBSTER, M., AND WARMUTH, M. Tracking the best expert. Machine Learning 32, 2 (August 1998).
13. JIN, R., AND AGARWAL, G. Efficient and effective decision tree construction on streaming data. In Proceedings of ACM SIGKDD (2003).
14. JUNG, J., KRISHNAMURTHY, B., AND RABINOVICH, M. Flash crowds and denial of service attacks: Characterization and implications for cdns and websites. In Proceedings of the International World Wide Web Conference (May 2002).
15. JUNG, J., AND SIT, E. An empirical study of spam traffic and the use of DNS black lists. In Proceedings of Internet Measurement Conference (IMC) (2004).
16. KOHLER, E., LI, J., PAXSON, V., AND SHENKER, S. Observed structure of addresses in IP traffic. IEEE/ACM Transactions in Networking 14, 6 (2006).
17. KRISHNAMURTHY, B., AND WANG, J. On network-aware clustering of web clients. In Proceedings of ACM SIGCOMM (2000).
18. MAO, Z. M., SEKAR, V., SPATSCHECK, O., VAN DER MERWE, J., AND VASUDEVAN, R. Analyzing large ddos attacks using multiple data sources. In ACM SIGCOMM Workshop on Large Scale Attack Defense (2006).
19. RAMACHANDRAN, A., AND FEAMSTER, N. Understanding the network-level behavior of spammers. In Proceedings of ACM SIGCOMM (2006).
20. SLEATOR, D. D., AND TARJAN, R. E. Amortized efficiency of list update and paging rules. In Communications of the ACM (1985), vol. 28, pp. 202-208.
21. SOLDO, F., MARKOPOULO, A., AND ARGYRAKI, K. Optimal filtering of source address prefixes: Models and algorithms. In Proceedings of IEEE Infocom 2009 (2009).
22. TWINING, D., WILLIAMSON, M. M., MOWBRAY, M., AND RAHMOUNI, M. Email prioritization: Reducing delays on legitimate mail caused by junk mail. In USENIX Annual Technical Conference (2004).
23. VENKATARAMAN, S., BLUM, A., SONG, D., SEN, S., AND SPATSCHECK, O. Tracking dynamic sources of malicious activity at internet-scale. Tech. Rep. TD-7NZS8K, AT&T Labs, 2009.
24. VENKATARAMAN, S., SEN, S., SPATSCHECK, O., HAFFNER, P., AND SONG, D. Exploiting network structure for proactive spam mitigation. In Proceedings of Usenix Security'07 (2007).
25. XIE, Y., YU, F., ACHAN, K., GILLUM, E., GOLDSZMIDT, M., AND WOBBER, T. How dynamic are IP addresses? In Proceedings of ACM SIGCOMM (2007).
26. ZHANG, J., PORRAS, P., AND ULRICH, J. Highly predictive blacklists. In Proceedings of Usenix Security'08 (2008).
27. ZHANG, Y., SINGH, S., SEN, S., DUFFIELD, N., AND LUND, C. Online identification of hierarchical heavy hitters: algorithms, evaluation, and applications. In IMC '04: Proceedings of the 4th ACM SIGCOMM conference on Internet measurement (New York, NY, USA, 2004), ACM, pp. 101-114.