Optimal source-based filtering of malicious traffic

IEEE/ACM Transactions on Networking

Volumn 20, Issue 2, 2012, Pages 381-395

  Soldo, Fabio ^a   Argyraki, Katerina ^b   Markopoulou, Athina ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b EPFL   (Switzerland)

Author keywords

Clustering algorithms; filtering; Internet; network security

Indexed keywords

ACCESS CONTROL LISTS; ATTACK SCENARIOS; COMPUTATIONALLY EFFICIENT; IP ADDRESSS; MALICIOUS TRAFFIC; SCARCE RESOURCES; TERNARY CONTENT ADDRESSABLE MEMORIES;

ACCESS CONTROL; CLUSTERING ALGORITHMS; FILTRATION; INTERNET; NETWORK SECURITY; OPTIMIZATION;

INTERNET PROTOCOLS;

EID: 84859991654     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2011.2161615     Document Type: Article

References (34)

1. "Understanding ACL on Catalyst 6500 series switches," Cisco Systems, San Jose, CA, 2003 [Online]. Available: http://www.cisco.com/en/US/ products/hw/switches/ps708/products-white-paper09186a00800c9470.shtml
2. "Protecting your core: Infrastructure protection access control lists," Cisco Systems, San Jose, CA, 2008 [Online]. Available: http://www.cisco.com/en/US/tech/tk648/tk361/technologies-white- paper09186a00801a1a55.shtml
3. M. Collins, T. Shimeall, S. Faber, J. Janies, R.Weaver,M.De Shon, and J. Kadane, "Using uncleanliness to predict future botnet addresses," in Proc. ACM Internet Meas. Conf., San Diego, CA, Oct. 2007, pp. 93-104.
4. Z. Chen, C. Ji, and P. Barford, "Spatial-temporal characteristics of internet malicious sources," in Proc. IEEE INFOCOM Mini-Conf., Phoenix, AZ, May 2008, pp. 2306-2314.
5. Z. Mao, V. Sekar, O. Spatscheck, J. Van Der Merwe, and R. Vasudevan, "Analyzing large DDoS attacks using multiple data sources," in Proc. ACM SIGCOMM Workshop Large-Scale Attack Defense, Pisa, Italy, Sep. 2006, pp. 161-168. (Pubitemid 46740687)
6. A. Ramachandran and N. Feamster, "Understanding the network-level behavior of spammers," in Proc. ACM SIGCOMM, Pisa, Italy, Sep. 2006, pp. 291-302. (Pubitemid 44623735)
7. S. Venkataraman, S. Sen, O. Spatscheck, P. Haffner, and D. Song, "Exploiting network structure for proactive spam mitigation," presented at the USENIX Security Symp., Boston, MA, Aug. 2007.
8. Y. Xie, F. Yu, K. Achan, E. Gillum, M. Goldszmidt, and T. Wobber, "How dynamic are IP addresses?," in Proc. ACM SIGCOMM, Kyoto, Japan, Aug. 2007, pp. 301-312. (Pubitemid 350239793)
9. J. Zhang, P. Porras, and J. Ullrich, "Highly predictive blacklisting," presented at the USENIX Security Symp., San Jose, CA, Jul. 2008.
10. "Dshield: Cooperative network security community-Internet security," Dshield.org [Online]. Available: http://www.dshield.org
11. H. Kellerer, U. Pferschy, and D. Pisinger, Knapsack Problems. New York: Springer-Verlag, 2004.
12. G. Varghese, Network Algorithmics: An Interdisciplinary Approach to Designing Fast Networked Devices. San Mateo, CA: Morgan Kaufmann, 2005.
13. S. Boyd and L. Vandenberghe, Convex Optimization. Cambridge, U.K.: Cambridge Univ. Press, 2004.
14. T. Kanungo, D. Mount, N. Netanyahu, C. Piatko, R. Silverman, and A. Wu, "An efficient k-means clustering algorithm: Analysis and implementation," IEEE Trans. Pattern Anal. Mach. Intell., vol. 24, no. 7, pp. 881-892, Jul. 2002. (Pubitemid 34835464)
15. G. Pack, J. Yoon, E. Collins, and C. Estan, "On filtering of DDoS attacks based on source address prefixes," presented at the SecureComm, Istanbul, Turkey, Sep. 2006.
16. E. Kohler, J. Li, V. Paxson, and S. Shenker, "Observed structure of addresses in IP traffic," in Proc. ACM SIGCOMM Workshop Internet Meas., Marseille, France, Nov. 2002, pp. 253-266.
17. Z. Chen and C. Ji, "Measuring network-aware worm spreading ability," in Proc. IEEE INFOCOM, Anchorage, AK, May 2007, pp. 116-124. (Pubitemid 47334222)
18. R. Xu and D. Wunsch, II, "Survey of clustering algorithms," IEEE Trans. Neural Netw., vol. 16, no. 3, pp. 645-678, May 2005. (Pubitemid 40718010)
19. R. Mahajan, S. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Schenker, "Controlling high bandwidth aggregates in the network," Comput. Commun. Rev., vol. 32, pp. 62-73, Jul. 2002.
20. K. Argyraki and D. Cheriton, "Scalable network-layer defense against internet bandwidth-flooding attacks," IEEE/ACMTrans. Netw., vol. 17, no. 4, pp. 1284-1297, Aug. 2009.
21. X. Liu, X. Yang, and Y. Lu, "To filter or to authorize: Network-layer DoS defense against multimillion-node botnets," in Proc. ACM SIGCOMM, Seattle, WA, Aug. 2008, pp. 195-206.
22. "High performance packet classification," HiPAC.org [Online]. Available: http://www.hipac.org/performance-tests/results.html
23. E. Al-Shaer and H. Hamed, "Firewall policy advisor," DePaul University, Chicago, IL, 2005 [Online]. Available: http://www.mnlab. cs.depaul.edu/projects/SPA
24. S. Venkataraman, A. Blum, D. Song, S. Sen, and O. Spatscheck, "Tracking dynamic sources of malicious activity at internet-scale," presented at the NIPS Whistler, BC, Canada, Dec. 2009.
25. Y. Zhang, S. Singh, S. Sen, N. Duffield, and C. Lund, "Online identification of hierarchical heavy hitters: Algorithms, evaluation, and applications," in Proc. ACM SIGCOMM Internet Meas. Conf., Taormina, Italy, Oct. 2004, pp. 101-114. (Pubitemid 40372035)
26. C. Estan, S. Savage, and G.Varghese, "Automatically inferring patterns of resource consumption in network traffic," in Proc. ACMSIGCOMM, Karlsruhe, Germany, Aug. 2003, pp. 137-148.
27. G. Cormode, F. Korn, S. Muthukrishnan, and D. Srivastava, "Diamond in the rough: Finding hierarchical heavy hitters in multi-dimensional data," in Proc. ACM SIGMOD Int. Conf. Manage. Data, Paris, France, Jun. 2004, pp. 155-166.
28. P. Gilmore and R. Gomory, "A linear programming approach to the cutting stock problem-Part II," Oper. Res., vol. 11, no. 6, pp. 863-888, 1963.
29. A. Caprara, H. Kellerer, U. Pferschy, and D. Pisinger, "Approximation algorithms for knapsack problems with cardinality constraints," Eur. J. Oper. Res., vol. 123, no. 2, pp. 333-345, 2000. (Pubitemid 30596940)
30. V. Li and G. Curry, "Solving multidimensional knapsack problems with generalized upper bound constraints using critical event tabu search," Comput. Oper. Res., vol. 32, no. 4, pp. 825-848, 2005.
31. A. Bagchi, N. Bhattacharyya, and N. Chakravarti, "LP relaxation of the two dimensional knapsack problem with box and GUB constraints," Eur. J. Oper. Res., vol. 89, no. 3, pp. 609-617, 1996. (Pubitemid 126386792)
32. I. de Farias, Jr and G. Nemhauser, "A polyhedral study of the cardinality constrained knapsack problem," Math. Program., vol. 96, no. 3, pp. 439-467, 2003.
33. F. Soldo, A. Markopoulou, and K. Argyraki, "Optimal filtering of source address prefixes: Models and algorithms," in Proc. IEEE INFOCOM, Rio de Janeiro, Brazil, Apr. 2009, pp. 2446-2454.
34. F. Soldo, K. El Defrawy, A. Markopoulou, B. Krishnamurthy, and J. Van Der Merwe, "Filtering sources of unwanted traffic," presented at the Inf. Theory Appl. Workshop, San Diego, CA, Jan. 2008.