Community-based analysis of netflow for early detection of security incidents

LISA 2011 - 25th Large Installation System Administration Conference

Volumn , Issue , 2011, Pages 241-252

  Weigert, Stefan ^a   Hiltunen, Matti A ^b   Fetzer, Christof ^a  

^a DRESDEN UNIVERSITY OF TECHNOLOGY   (Germany)

^b AT AND T LABS RESEARCH   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BANKING INDUSTRY; COMMUNITY-BASED; DETECTION THRESHOLD; ENERGY GENERATIONS; NON-INTRUSIVE; SECURITY INCIDENT; SYSTEM ADMINISTRATORS; TOOLS AND TECHNIQUES;

EID: 84879742305     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (21)

1. R. Berthier, M. Cukier, M. Hiltunen, D. Kormann, G. Vesonder, and D. Sheleheda. Nfsight: netflow-based network awareness tool. In Proceedings of the 24th USENIX LISA, 2010.
2. A. Cirneci, S. Boboc, C. Leordeanu, V. Cristea, and C. Estan. Netpy: Advanced Network Traffic Monitoring. In Proc. Int Conf. on Intelligent Networking and Collaborative Systems (INCOS'09), pages 253-254, 2009.
3. Corinna Cortes, Daryl Pregibon, and Chris Volinsky. Communities of interest. In Frank Hoffmann, David Hand, Niall Adams, Douglas Fisher, and Gabriela Guimaraes, editors, Advances in Intelligent Data Analysis, volume 2189 of Lecture Notes in Computer Science, pages 105-114. Springer Berlin / Heidelberg, 2001. 10.1007/3-540-44816-0_11.
4. M. Costa, J. Crowcroft, M. Castro, A. Rowstron, L. Zhou, L. Zhang, and P. Barham. Vigilante: End-to-end containment of internet worms. In Proceedings of the ACM Symposium on Operating Systems Principles (SOSP), 2005.
5. A.D. D'Amico, J.R. Goodall, D.R. Tesone, and J.K. Kopylec. Visual discovery in computer network defense. IEEE Computer Graphics and Applications, 27(5):20-27, 2007.
6. F. Fischer, F. Mansmann, D.A. Keim, S. Pietzko, and M. Waldvogel. Large-scale network monitoring for visual analysis of attacks. In Proc. Workshop on Visualization for Computer Security (VizSEC), page 111. Springer, 2008.
7. C. Gates, M. Collins, M. Duggan, A. Kompanek, and M. Thomas. More NetFlow tools: For performance and security. In Proc. 18th USENIX LISA, pages 121-132, 2004.
8. G. Gu, R. Perdisci, J. Zhang, and W. Lee. Botminer: Clustering analysis of network traffic for protocol- and structure-independent botnet detection. In Proceedings of the USENIX Security Conference, 2008.
9. P. Haag. Watch your Flows with NfSen and NFDUMP. In 50th RIPE Meeting, 2005.
10. V. Igure, S. Laughter, and R. Williams. Security issues in scada networks. Computers & Security, 25(7):498 - 506, 2006.
11. Ben Liblit. Cooperative bug isolation: winning thesis of the 2005 ACM doctoral dissertation competition. Springer-Verlag, Berlin, Heidelberg, 2007.
12. André Martin, Thomas Knauth, Stephan Creutz, Diogo Becker de Brum, Stefan Weigert, Andrey Brito, and Christof Fetzer. Low-overhead fault tolerance for high-throughput data processing systems. In ICDCS '11: Proceedings of the 2011 31st IEEE International Conference on Distributed Computing Systems, page TBD, Los Alamitos, CA, USA, June 2011. IEEE Computer Society.
13. J. Perkins, S. Kim, S. Larsen, S. Amarasinghe, J. Bachrach, M. Carbin, C. Pacheco, F. Sherwood, S. Sidiroglou, G. Sullivan, W.-F. Wong, Y. Zibin, M. Ernst, and M. Rinard. Self-defending software: Automatically patching security vulnerabilities. In Proceedings of the ACM Symposium on Operating Systems Principles (SOSP), 2009.
14. D. Plonka. Flowscan: A Network Traffic Flow Reporting and Visualization Tool. In Proc. 14th USENIX LISA, pages 305-318, 2000.
15. F. Qian, Z. Qian, Z. M. Mao, and A. Prakash. Ensemble: Community-based anomaly detection for popular applications. 5th International ICST Conference on Security and Privacy in Communication Networks, May 2009.
16. S. Romig, M. Fullmer, and R. Luman. The OSU flow-tools package and CISCO NetFlow logs. In Proc. 14th USENIX LISA, pages 291-304, 2000.
17. C. So-In. A Survey of Network Traffic Monitoring and Analysis Tools. Cse 576m computer system analysis project, Washington University in St. Louis, 2009.
18. T. Taylor, D. Paterson, J. Glanfield, C. Gates, S. Brooks, and J. McHugh. FloVis: Flow Visualization System. In Proc. Cybersecurity Applications and Technologies Conference for Homeland Security (CATCH), pages 186-198, 2009.
19. H. Wang, J. Platt, Y. Chen, R. Zhang, and Y.-M. Wang. Automatic misconfiguration troubleshooting with peerpressure. In In OSDI, pages 245-258, 2004.
20. W. Yurcik. VisFlowConnect-IP: a link-based visualization of Netflows for security monitoring. In 18th Annual FIRST Conf. on Computer Security Incident Handling, 2006.
21. Y. Zeng, X. Hu, and K. Shin. Detection of botnets using combined host- and network-level information. In Proceedings of the 40th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2010.