An event-based platform for collaborative threats detection and monitoring

Information Systems

Volumn 39, Issue 1, 2014, Pages 175-195

  Lodi, Giorgia ^a   Aniello, Leonardo ^a   Di Luna, Giuseppe A ^a   Baldoni, Roberto ^a  

^a SAPIENZA UNIVERSITY OF ROME   (Italy)

Author keywords

Collaborative information systems; Event processing; Fraud monitoring; Information systems monitoring; Security threats

Indexed keywords

COLLABORATIVE INFORMATION SYSTEMS; DETECTION ACCURACY; DETECTION DELAYS; EVENT PROCESSING; FINANCIAL ORGANIZATIONS; LAW-ENFORCEMENT AGENCIES; MONITORING SYSTEM; SECURITY THREATS;

ABSTRACTING; CRIME; DISTRIBUTED COMPUTER SYSTEMS; INFORMATION SYSTEMS; INTRUSION DETECTION; LAWS AND LEGISLATION; SECURITY SYSTEMS; SEMANTIC WEB; SEMANTICS; SOCIETIES AND INSTITUTIONS;

DAMAGE DETECTION;

EID: 84884841868     PISSN: 03064379     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.is.2013.07.005     Document Type: Article

References (67)

1. Global Fraud Report - Annual Edition 2011-2012, Kroll, 2011 http://www.krollconsulting.com/fraud-report/2011-12/press-only/
2. In the Crossfire: Critical Infrastructure in the Age of Cyber War, 2010 http://www.mcafee.com/us/resources/reports/rp-in-crossfire-critical- infrastructure-cyber-war.pdf
3. Information Sharing Strategy - National Intelligence, 2008 http://www.dni.gov/reports/IC-Information-Sharing-Strategy.pdf
4. NATO Network Enabled Capability, 2011 http://nnec.act.nato.int/
5. H.F. Lipson, Tracking and Tracing Cyber-Attacks: Technical Challenges and Global Policy, vol. 154, University of Pennsylvania Law Review, 2006, p. 477.
6. National Australia Bank it by DDoS Attack, 2009 http://www.zdnet.com.au/ news/security/soa/National-Australia-Bank-hit-by-DDoS-attack/0,130061744, 339271790,00.htm
7. Update: Credit Card Firm Hit by DDoS Attack, 2009 http://www. computerworld.com/securitytopics/security/story/0,10801,96099,00.html
8. FBI Investigates 9 Million ATM Scam, 2010 http://www.myfoxny.com/dpp/ news/090202-FBI-Investigates-9-Million-ATM-Scam
9. Financial Services - Information Sharing and Analysis Center, 2011 http://www.fsisac.com/
10. European Anti Fraud Office, 2011 http://ec.europa.eu/anti-fraud/index-it. html
11. Y. Xie, V. Sekar, M.K. Reiter, H. Zhang, Forensic analysis for epidemic attacks in federated networks, in: Proceedings of the 14th International Conference on Network Protocols, IEEE, 2006, pp. 43-53.
12. G. Zhang, M. Parashar, Cooperative detection and protection against network attacks using decentralized information sharing, in: Cluster Computing, vol. 13, Kluwer Academic Publishers, 2010, pp. 67-86.
13. Where Complex Event Processing meets Open Source: Esper and NEsper, 2009 http://esper.codehaus.org/
14. A. Adi, O. Etzion, Amit - the situation manager, The VLDB Journal 13 (2004) 177-203 (Springer-Verlag). (Pubitemid 38700768)
15. L. Amini, N. Jain, A. Sehgal, J. Silber, O. Verscheure, Adaptive control of extreme-scale stream processing systems, in: Proceedings of the 26th International Conference on Distributed Computing Systems, IEEE, 2006, p. 71.
16. X.J. Zhang, H. Andrade, B. Gedik, R. King, J. Morar, S. Nathan, Y. Park, R. Pavuluri, E. Pring, R. Schnier, P. Selo, M. Spicer, V. Uhlig, C. Venkatramani, Implementing a high-volume, low-latency market data processing system on commodity hardware using IBM middleware, in: Proceedings of the 2nd Workshop on High Performance Computational Finance, ACM, 2009, pp. 7:1-7:8.
17. M. Akdere, U. Çetintemel, N. Tatbul, Plan-based complex event detection across distributed sources, in: Proceedings of the VLDB Endowment, vol. 1, VLDB Endowment, 2008, pp. 66-77.
18. P.R. Pietzuch, Hermes: A Scalable Event-Based Middleware, Ph.D. Thesis, University of Cambridge, 2004.
19. JBoss Drools Fusion, 2010 http://www.jboss.org/drools/drools-fusion.html
20. Y. Huang, N. Feamser, A. Lakhina, J.J. Xu, Diagnosing network disruptions with network-wide analysis, in: Proceedings of the International Conference on Measurement and Modeling of Computer Systems, ACM, 2007, pp. 61-72. (Pubitemid 350158073)
21. DShield: Cooperative Network Security Community - Internet Security, 2009 http://www.dshield.org/indexd.html/
22. Complete Snort-based IDS Architecture, 2002 http://cybervlad.net/ids/ index.html
23. C. Kreibich, R. Sommer, Policy-controlled event management for distributed intrusion detection, in: Proceedings of the 25th IEEE International Conference on Distributed Computing Systems Workshops, IEEE, 2005, pp. 385-391.
24. M.E. Locasto, J.J. Parekh, A.D. Keromytis, S.J. Stolfo, Towards collaborative security and p2p intrusion detection, in: Proceedings of the Information Assurance Workshop, IEEE, 2005, pp. 30-36.
25. R. Baldoni, G. Lodi, G. Chockler, E. Dekel, B.P. Mulcahy, G. Martufi, A contract-based event driven model for collaborative security in financial information systems, in: Proceedings of the 12th International Conference on Enterprise Information Systems, vol. 4, SciTePress, 2010, pp. 147-152.
26. C.V. Zhou, S. Karunasekera, C. Leckie, A peer-to-peer collaborative intrusion detection system, in: Proceedings of the 13th International Conference on Networks, vol. 1, IEEE, 2005, pp. 118-123.
27. N. Verma, F. Trousset, P. Poncelet, F. Masseglia, Intrusion detections in collaborative organizations by preserving privacy, in: Advances in Knowledge Discovery and Management, Springer, 2009, pp. 235-247.
28. C.V. Zhou, C. Leckie, and S. Karunasekera A survey of coordinated attacks and collaborative intrusion detection Computers & Security 29 2010 124 140 (Elsevier)
29. D. Jeffrey, S. Ghemawat, MapReduce: simplified data processing on large clusters, in: Proceedings of the 6th Conference on Symposium on Operating Systems Design & Implementation, USENIX Association, vol. 6, 2004, pp. 137-149.
30. D. Lamanna, J. Skene, W. Emmerich, SLAng: a language for defining service level agreements, in: Proceedings of the 9th IEEE Workshop on Future Trends of Distributed Computing Systems, IEEE, 2003, p. 100.
31. J. Jung, V. Paxson, A.W. Berger, H. Balakrishnan, Fast portscan detection using sequential hypothesis testing, in: Proceedings of the Symposium on Security and Privacy, IEEE, 2004, pp. 211-225.
32. H. Singh, R. Chun, Distributed Port Scan, Handbook of Information and Communication Security - Part B, Springer, 2010, pp. 221-234.
33. W.G. Hai Zhang, Xuyang Zhu, Tcp portscan detection based on single packet flows and entropy, in: Proceedings of the 2nd International Conference on Interaction Sciences: Information Technology, Culture and Human, ACM, 2009, pp. 1056-1060.
34. Snort: An Open Source Network Intrusion Prevention and Detection System (IDS/IPS), 2010 http://www.snort.org/
35. L. Aniello, G. Lodi, R. Baldoni, Inter-domain stealthy port scan detection through complex event processing, in: Proceedings of the 13th European Workshop on Dependable Computing, ACM, 2011, pp. 67-72.
36. L. Aniello, G.A. Di Luna, R. Baldoni, A collaborative event processing system for protection of critical infrastructures from cyber attacks, in: Proceedings of the 30th Conference on System Safety, Reliability and Security, Springer-Verlag, 2011, pp. 310-323.
37. WANem The Wide Area Network Emulator, 2011 http://wanem.sourceforge.net/
38. ITOC Research: CDX Datasets, 2010 http://www.itoc.usma.edu/research/ dataset/index.html
39. LBNL/ICSI Enterprise Tracing Project, 2010 http://www.icir.org/ enterprise-tracing/
40. 2000 DARPA Intrusion Detection Scenario Specific Data Sets, 2000 http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/2000data. html
41. C. Zhou, S. Karunasekera, C. Leckie, Evaluation of a decentralized architecture for large scale collaborative intrusion detection, in: Proceedings of the 10th International Symposium on Integrated Network Management, IEEE, 2007, pp. 80-89. (Pubitemid 47485161)
42. Dipartimento del Tesoro - Anti Fraud System, 2011 http://www.dt.tesoro. it/en/antifrode-mezzi-pagamento/
43. Bugra Gedik, Henrique Andrade, Kun-Lung Wu, Philip S. Yu, Myungcheol Doo, SPADE: the System S declarative stream processing engine, in: Proceedings of the International Conference on Management of Data, ACM, 2008, pp. 1123-1134.
44. Storm, Distributed and Fault-Tolerant Realtime Computation, 2011 〈 http://storm-project.net/
45. L. Kissner, D. Song, Privacy-preserving set operations, in: Proceedings of the 25th Annual International Cryptology Conference, Springer, 2005, pp. 241-257. (Pubitemid 43902117)
46. G. Ateniese, R. Baldoni, S. Bonomi, G. Di Luna, Oblivious assignment with m-slot, in: Proceedings of the 14th International Symposium on Stabilization, Safety, and Security of Distributed Systems, Springer-Verlag, 2012, pp. 187-201.
47. P. Golle, M. Jakobsson, A. Juels, P. Syverson, Universal re-encryption for mixnets, in: Proceedings of the RSA Conference, Cryptographers track, Springer-Verlag, 2002, pp. 163-178.
48. B. Applebaum, H. Ringberg, M. J. Freedman, M. Caesar, J. Rexford, Collaborative, privacy-preserving data aggregation at scale, in: Proceedings of the 10th International Conference on Privacy Enhancing Technologies, Springer-Verlag, 2010, pp. 56-74.
49. D. Bogdanov, S. Laur, J. Willemson, Sharemind: a framework for fast privacy-preserving computations, in: Proceedings of the 13th European Symposium on Research in Computer Security, Springer, 2008, pp. 192-206.
50. N. Nisan, B. Pinkas, Y. Sella, Fairplay: a secure two-party computation system, in: Proceedings of the 13th Conference on USENIX Security Symposium, vol. 13, ACM, 2004, p. 20.
51. H. Kargupta, Multi-agent, distributed, privacy-preserving data management and data mining, US Patent 0017870 A1, 2008.
52. N. Avourdiadis, A. Blyth, Data unification and data fusion of intrusion detection logs in a network centric environment, in: Proceedings of the 4th European Conference on Information Warfare and Security, 2005, pp. 9-20.
53. R. Baldoni, G.A. Di Luna L. Querzoni, Collaborative detection of coordinated port scans, in: Proceedings of the 14th International Conference on Distributed Computing and Networking, Springer, 2013, pp. 102-117.
54. L. Aniello, R. Baldoni, L. Querzoni, Adaptive online scheduling in storm, in: Proceedings of the 7th ACM International Conference on Distributed Event-Based Systems, ACM, 2013, pp. 207-218.
55. S.R.M. Oliveira, O.R. Zaiane, Y. Saygin, Secure association rule sharing, in: Proceedings of the 8th Pacific-Asia Conference on Advances in Knowledge Discovery and Data Mining, Springer, Berlin, Heidelberg, 2004, pp. 74-85. (Pubitemid 38824885)
56. Y. Saygin, V.S. Verykios, C. Clifton, Using unknowns to prevent discovery of association rules, in: SIGMOD Record, ACM, 2001, pp. 45-54. (Pubitemid 33720998)
57. L. Chang, I.S. Moskowitz, Parsimonious downgrading and decision trees applied to the inference problem, in: Proceedings of the Workshop on New Security Paradigms, vol. 30, ACM, 1998, pp. 82-89.
58. I.S. Moskowitz, L. Chang, A decision theoretical based system for information downgrading, in: Proceedings of the 5th Joint Conference on Information Sciences, 2000.
59. D. Dobkin, A.K. Jones, R.J. Lipton, Secure databases: protection against user influence, in: Transactions on Database Systems, ACM, 1979, pp. 97-106. (Pubitemid 9437765)
60. K. Kenthapadi, N. Mishra, K. Nissim, Simulatable auditing, in: Proceedings of the 24th SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, ACM, 2005, pp. 118-127. (Pubitemid 43275475)
61. R. Agrawal, R. Srikant, Privacy-preserving data mining, in: Proceedings of the SIGMOD International Conference on Management of Data, ACM, 2000, pp. 439-450.
62. D. Dakshi, C.C. Aggarwal, On the design and quantification of privacy preserving data mining algorithms, in: Proceedings of the 20th SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, ACM, 2001, pp. 247-255. (Pubitemid 32865987)
63. P. Samarati, Protecting respondents' identities in microdata release, in: Transactions on Knowledge and Data Engineering, IEEE, 2001, pp. 1010-1027. (Pubitemid 34035590)
64. A. Machanavajjhala, D. Kifer, J. Gehrke, M. Venkitasubramaniam, L-diversity: privacy beyond k-anonymity, in: Transactions on Knowledge Discovery from Data, ACM, 2007, p. 24.
65. C.C. Aggarwal, P.S. Yu, On variable constraints in privacy preserving data mining, in: Proceedings of the 5th International Conference on Data Mining, SIAM, 2005, pp. 115-125.
66. L. Aniello, R. Baldoni, G. Chockler, G. Laventman, G. Lodi, Y. Vigfusson, "Distributed Attack Detection Using Agilis" in R. Baldoni, G. Chockler (Eds) "Collaborative Financial Infrastructure Protection", Springer, pp. 157-174, 2012.
67. R. Baldoni, G. Chockler (Eds) "Collaborative Financial Infrastructure Protection", Springer, 2012.