Highly predictive blacklisting

Proceedings of the 17th USENIX Security Symposium

Volumn , Issue , 2008, Pages 107-122

  Zhang, Jian ^a   Porras, Phillip ^a   Ullrich, Johannes ^b  

^a SRI INTERNATIONAL   (United States)

^b SANS Institute   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DEFENSIVE MEASURES; INDIVIDUAL NETWORK; INTERNET COMMUNITIES; MALWARE PROPAGATION; PERIMETER DEFENSE; POTENTIAL THREATS; RELEVANCE RANKING; UNWANTED TRAFFIC;

MALWARE;

EID: 85077707798     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (24)

1. ANAGNOSTAKIS, K. G., GREENWALD, M. B., IOANNIDIS, S., KEROMYTIS, A. D., AND LI, D. A cooperative immunization system for an untrusting Internet. In Proceedings of the 11th IEEE International Conference on Networks (ICON’03) (October 2003).
2. BRIN, S., AND PAGE, L. The anatomy of a large-scale hypertextual Web search engine. Computer Networks and ISDN Systems 30, 1-7 (1998), 107–117.
3. CAI, M., HWANG, K., KWOK, Y., SONG, S., AND CHEN, Y. Collaborative Internet worm containment. IEEE Security and Privacy Magazine 3, 3 (May/June 2005), 25–33.
4. CHEN, Z., AND JI, C. Optimal worm-scanning method using vulnerable-host distributions. International Journal of Security and Networks (IJSN) Special Issue on Computer & Network Security 2, 1 (2007).
5. COPPERSMITH, D., AND WINOGRAD, S. Matrix multiplication via arithmetic progressions. Journal of Symbolic Computation 9 (1990), 251–280.
6. HUMPHRYS, M. The Internet in the 1980s. http://www.computing.dcu.ie/~humphrys/net.80s.html, 2007.
7. INCORPORATED, G. List of blacklists. http://directory.google.com/Top/Computers/ Internet/Abuse/Spam/Blacklist%s/, 2007.
8. INCORPORATED, G. Live-feed anti-phishing blacklist. http://sb.google.com/safebrowsing/update?version=goog-black-url:1:1, 2007.
9. JUNG, J., PAXSON, V., BERGER, A. W., AND BALAKRISHNAN, H. Fast portscan detection using sequential hypothesis testing. In IEEE Symposium on Security and Privacy 2004 (Oakland, CA, May 2004).
10. KATTI, S., KRISHNAMURTHY, B., AND KATABI, D. Collaborating against common enemies. In Proceedings of the ACM SIGCOMM/USENIX Internet Measurement Conference (October 2005).
11. KIM, H.-A., AND KARP, B. Autograph: Toward automated, distributed worm signature detection. In USENIX Security Symposium (2004), pp. 271–286.
12. LOCASTO, M., PAREKH, J., KEROMYTIS, A., AND STOLFO, S. Towards collaborative security and P2P intrusion detection. In Proceedings of the 2005 IEEE Workshop on Information Assurance and Security (June 2005).
13. M.GORI, AND PUCCI, A. Itemrank: A random-walk based scoring algorithm for recommender engines. In Proceedings of the International Joint Conference on Artificial Intelligence (January 2007).
14. PORRAS, P., BRIESEMEISTER, L., SKINNER, K., LEVITT, K., ROWE, J., AND TING, Y. A hybrid quarantine defense. In Proceedings of the 2004 ACM Workshop on Rapid Malcode (WORM) (October 2004).
15. RUOMING, P., YEGNESWARAN, V., BARFORD, P., PAXSON, V., AND PETERSON, L. Characteristics of internet background radiation. In Proceedings of ACM SIGCOMM/USENIX Internet Measurement Conference (October 2004).
16. THOMAS, R. Bogon dotted decimal list v3.9. http://www.cymru.com/Documents/bogon-dd.hml, October 2007.
17. ULLRICH, J. DShield global worst offender list. https://feeds.dshield.org/block.txt.
18. VIXIE, P., AND RAND, D. Mail abuse prevention system (MAPS). http://www.mail-abuse.com, 1997.
19. WISSNER-GROSS, A. D. Preparation of topical readings lists from the link structure of Wikipedia. In Proceedings of the IEEE International Conference on Advanced Learning Technology (July 2006).
20. YEGNESWARAN, V., BARFORD, P., AND ULLRICH, J. Internet intrusions: global characteristics and prevalence. In Proceedings of ACM SIGMETRICS (June 2003).
21. YEGNESWARAN, V., PORRAS, P., SAIDI, H., SHARIF, M., AND NARAYANAN, A. The Cyber-TA compendium honeynet page. http://www.cyber-ta.org/Honeynet.
22. ZHANG, J., PORRAS, P., AND ULLRICH, J. The DSHIELD highly predictive blacklisting service. http://www.dshield.org/hpbinfo.html.
23. ZHANG, J., PORRAS, P., AND ULLRICH, J. A new service for increasing the effectiveness of network address blacklists. In Proceedings of the 3rd Workshop of Steps to Reduce Unwanted Traffic on the Internet (June 2007).
24. ZHANG, J., PORRAS, P., AND ULLRICH, J. Gaussian process learning for cyber-attack early warning. to appear in Proceedings of SIAM Conference on data mining (2008).