Provenance-aware security risk analysis for hosts and network flows

IEEE/IFIP NOMS 2014 - IEEE/IFIP Network Operations and Management Symposium: Management in a Software Defined World

Volumn , Issue , 2014, Pages

  Rezvani, Mohsen ^a   Ignjatovic, Aleksandar ^a   Bertino, Elisa ^b   Jha, Sanjay ^a  

^a UNIVERSITY OF NEW SOUTH WALES   (Australia)

^b PURDUE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ITERATIVE METHODS;

DEEP PACKET INSPECTION (DPI); FLOW INFLUENCE; HIGH THROUGHPUT; ITERATIVE METHODOLOGY; NETWORK FLOWS; RISK NETWORKS; RISK SCORE; SECURITY RISK ANALYSIS;

RISK ASSESSMENT;

EID: 84904188964     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NOMS.2014.6838250     Document Type: Conference Paper

References (17)

1. S. Wang, R. State, M. Ourdane, and T. Engel, "Risk Rank: Security risk ranking for IP flow records," in Network and Service Management (CNSM), 2010 International Conference on, oct. 2010, pp. 56-63.
2. A. Borodin, G. O. Roberts, J. S. Rosenthal, and P. Tsaparas, "Link analysis ranking: algorithms, theory, and experiments," ACM Trans. Internet Technol., vol. 5, no. 1, pp. 231-297, Feb. 2005.
3. J. M. Kleinberg, "Authoritative sources in a hyperlinked environment," J. ACM, vol. 46, no. 5, pp. 604-632, Sep. 1999.
4. S. Wang, R. State, M. Ourdane, and T. Engel, "Mining netflow records for critical network activities," in Proceedings of the Mechanisms for autonomous management of networks and services, and 4th international conference on Autonomous infrastructure, management and security, ser. AIMS'10, 2010, pp. 135-146.
5. H.-S. Lim, Y.-S. Moon, and E. Bertino, "Provenance-based trustworthiness assessment in sensor networks," in Proceedings of the Seventh International Workshop on Data Management for Sensor Networks, ser. DMSN '10, 2010, pp. 2-7.
6. "MIT Lincoln laboratory, cyber systems & technology, DARPA intrusion detection, Lincoln laboratory scenario (DDoS) 1.0."
7. "Emsisoft portlist - all known TCP and UDP ports of malware, trojans, spyware, viruses," http://www.emsisoft.com/en/kb/portlist/, [Online; accessed 1-October-2012].
8. "The Honeynet project, scan 18," http://old.honeynet.org/scans/ scan18/, [Online; accessed 1-October-2012].
9. M. V. Mahoney and P. K. Chan, "An analysis of the 1999 DARPA/Lincoln laboratory evaluation data for network anomaly detection," in In Proceedings of the Sixth International Symposium on Recent Advances in Intrusion Detection. Springer-Verlag, 2003, pp. 220-237.
10. M. Roesch, "Snort - lightweight intrusion detection for networks," in Proceedings of the 13th USENIX conference on System administration, ser. LISA '99. Berkeley, CA, USA: USENIX Association, 1999, pp. 229-238. [Online]. Available: http://dl.acm.org/citation.cfm?id= 1039834.1039864
11. P. Berkhin, "A survey on Page Rank computing," Internet Mathematics, vol. 2, no. 1, pp. 73-120, 2005.
12. X. Chen, M. Zhang, Z. M. Mao, and P. Bahl, "Automating network application dependency discovery: experiences, limitations, and new solutions," in Proceedings of the 8th USENIX conference on Operating systems design and implementation, ser. OSDI'08, 2008, pp. 117-130.
13. M. Iliofotou, P. Pappu, M. Faloutsos, M. Mitzenmacher, S. Singh, and G. Varghese, "Network monitoring using traffic dispersion graphs (TDGs)," in Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, ser. IMC '07, 2007, pp. 315-320.
14. S. Kandula, R. Chandra, and D. Katabi, "What's going on?: learning communication rules in edge networks," SIGCOMM Comput. Commun. Rev., vol. 38, no. 4, pp. 87-98, Aug. 2008.
15. R. E. Sawilla and X. Ou, "Identifying critical attack assets in dependency attack graphs," in Proceedings of the 13th European Symposium on Research in Computer Security: Computer Security, ser. ESORICS '08, 2008, pp. 18-34.
16. S. Wang, R. State, M. Ourdane, and T. Engel, "Flow Rank: ranking Net Flow records," in Proceedings of the 6th International Wireless Communications and Mobile Computing Conference, ser. IWCMC '10, 2010, pp. 484-488.
17. N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner, "Open Flow: enabling innovation in campus networks," SIGCOMM Comput. Commun. Rev., vol. 38, no. 2, pp. 69-74, Mar. 2008.