COFFEE: A concept based on OpenFlow to filter and erase events of botnet activity at high-speed nodes

Lecture Notes in Informatics (LNI), Proceedings - Series of the Gesellschaft fur Informatik (GI)

Volumn 220, Issue , 2013, Pages 2225-2239

  Schehlmann, Lisa ^a   Baier, Harald ^a  

^a Fachbereich Bau und Umweltingenieurwesen   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNET; INTERNET SERVICE PROVIDERS; SOCIAL COMPUTING;

COMMAND AND CONTROL; DETECTION ALGORITHM; FALSE POSITIVE RATES; INTERNET SERVICE PROVIDERS (ISP); LARGE-SCALE NETWORK; NETWORK CONNECTION; OPERATIONAL ENVIRONMENTS; SOFTWARE DEFINED NETWORKING (SDN);

HIGH SPEED NETWORKS;

EID: 85016581151     PISSN: 16175468     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (24)

1. Sebastian Abt and Harald Baier. Towards Efficient and Privacy-Preserving Network-Based Botnet Detection Using Netflow Data. In Proceedings of 9th International Network Conference, INC '12, Port Elizabeth, South Africa, July 2012.
2. Leyla Bilge, Davide Balzarotti, William Robertson, Engin Kirda, and Christopher Kruegel. DISCLOSURE: Detecting Botnet Command and Control Servers Through Large-Scale NetFlow Analysis. In Proceedings of the 28th Annual Computer Security Applications Conference, ACSAC '12, pages 129-138, New York, NY, USA, 2012. ACM.
3. Rodrigo Braga, Edjard Mota, and Alexandre Passito. Lightweight DDoS Flooding Attack Detection Using NOX/OpenFlow. In Proceedings of the 2010 IEEE 35th Conference on Local Computer Networks, LCN '10, pages 408-415, Washington, DC, USA, 2010. IEEE Computer Society.
4. Cisco Systems, Inc. NetFlow Services Solutions Guide. http://www.cisco.com/en/US/docs/ios/solutions-docs/netflow/nfwhite.html, January 2007.
5. Maryam Feily, Alireza Shahrestani, and Sureswaran Ramadass. A Survey of Botnet and Botnet Detection. In Proceedings of the 2009 Third International Conference on Emerging Security Information, Systems and Technologies, SECURWARE '09, pages 268-273, Washington, DC, USA, 2009. IEEE Computer Society.
6. Jérôme François, Shaonan Wang, Radu State, and Thomas Engel. BotTrack: Tracking Botnets using NetFlow and PageRank. In 10th International IFIP TC 6 Networking Conference - Part I, NETWORKING '11, pages 1-14, Valencia, Spain, 2011. SpringerVerlag.
7. Jan Goebel and Thorsten Holz. Rishi: Identify Bot Contaminated Hosts by IRC Nickname Evaluation. In Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, HotBots '07, pages 8-8, Berkeley, CA, USA, 2007. USENIX Association.
8. Yu Gu, Andrew McCallum, and Don Towsley. Detecting Anomalies in Network Traffic Using Maximum Entropy Estimation. In Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement, IMC '05, pages 32-32, Berkeley, CA, USA, 2005. USENIX Association.
9. Google Inc. Inter-Datacenter WAN with centralized TE using SDN and OpenFlow. case study, Google Inc., 2012. https://www.opennetworking.org/images/stories/downloads/sdn-resources/customer-case-studies/cs-googlesdn.pdf.
10. Satoshi Kondo and Naoshi Sato. Botnet traffic detection techniques by C&C session classification using SVM. In Proceedings of the Security 2nd international conference on Advances in information and computer security, IWSEC'07, pages 91-104, Berlin, Heidelberg, 2007. Springer-Verlag.
11. Nick McKeown, Tom Anderson, Hari Balakrishnan, Guru Parulkar, Larry Peterson, Jennifer Rexford, Scott Shenker, and Jonathan Turner. OpenFlow: Enabling Innovation in Campus Networks. SIGCOMM Comput. Commun. Rev., 38(2):69-74, March 2008.
12. Matthew V. Mahoney. Network Traffic Anomaly Detection Based on Packet Bytes. In Proceedings of the 2003 ACM symposium on Applied computing, SAC '03, pages 346-350, New York, NY, USA, 2003. ACM.
13. Syed Akbar Mehdi, Junaid Khalid, and Syed Ali Khayam. Revisiting Traffic Anomaly Detection using Software Defined Networking. In Proceedings of the 14th international conference on Recent Advances in Intrusion Detection, RAID '11, pages 161-180, Berlin, Heidelberg, 2011. Springer-Verlag.
14. Open Networking Foundation. OpenFlow Switch Specification 1.1.0, Februar 2011.
15. Open Networking Foundation. Software-Defined Networking: The New Norm for Networks. White Paper, April 2012.
16. Lawrence Page, Sergey Brin, Rajeev Motwani, and Terry Winograd. The PageRank Citation Ranking: Bringing Order to the Web. In Proceedings of the 7th International World Wide Web Conference, WWW '98, pages 161-172, Brisbane, Australia, 1998.
17. project consortium of NetFlowBot. Anforderungsbeschreibung LOEWE3-Projekt Net-FlowBot. requirements document, project consortium of NetFlowBot, 2012.
18. Stuart E. Schechter, Jaeyeon Jung, and Arthur W. Berger. Fast Detection of Scanning Worm Infections. In Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection, RAID '04, pages 59-81, 2004.
19. Jessica Steinberger, Lisa Schehlmann, Sebastian Abt, and Harald Baier. Anomaly detection and mitigation at Internet scale: A survey. In Proceedings of the 7th International Conference on Autonomous Infrastructure, Management and Security, AIMS '13, Barcelona, Spain, 2013. Springer.
20. Sérgio S. C. Silva, Rodrigo M. P. Silva, Raquel C. G. Pinto, and Ronaldo M. Salles. Botnets: A survey. Computer Networks, 57(2):378-403, 2013.
21. Florian Tegeler, Xiaoming Fu, Giovanni Vigna, and Christopher Kruegel. BotFinder: Finding Bots in Network Traffic Without Deep Packet Inspection. In Proceedings of the 8th international conference on Emerging networking experiments and technologies, CoNEXT '12, pages 349-360, New York, NY, USA, 2012. ACM.
22. Jamie Twycross and Matthew M. Williamson. Implementing and testing a virus throttle. in Proceedings of the 12th conference on USENIX Security Symposium - Volume 12, SSYM '03, Berkeley, CA, USA, 2003. USENIX Association.
23. Ricardo Villamarin-Salomon and Jos Carlos Brustoloni. Identifying Botnets Using Anomaly Detection Techniques Applied to DNS Traffic. In Consumer Communications and Networking Conference, 2008. CCNC '08. 5th IEEE, pages 476-481, 2008.
24. Matthew M. Williamson. Throttling Viruses: Restricting propagation to defeat malicious mobile code. In Proceedings of the 18th Annual Computer Security Applications Conference, ACSAC '02, pages 61-68, Washington, DC, USA, 2002. IEEE Computer Society.