The Internet Motion Sensor: A Distributed Blackhole Monitoring System

Proceedings of the Symposium on Network and Distributed System Security, NDSS 2005

Volumn , Issue , 2005, Pages

  Bailey, Michael ^a   Cooke, Evan ^a   Jahanian, Farnam ^a   Nazario, Jose ^a,b   Watson, David ^a  

^a University of Michigan   (United States)

^b Arbor Networks   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

NETWORK SECURITY; SEMANTICS;

BLACKHOLE MONITORING; DATA NETWORK; DENIALOF- SERVICE ATTACKS; DISTRIBUTED DENIAL OF SERVICE; GLOBAL DATA; INTERNET MOTION SENSORS; MONITORING SYSTEM; NATIONAL INFRASTRUCTURE; NETWORK ASSETS; SERVICE ROUTING;

DENIAL-OF-SERVICE ATTACK;

EID: 85081770459     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (34)

1. CERT. Incident Note IN-2004-01: W32/Novarg.A Virus. http://www.cert.org/incident_notes/IN-2004-01. html, 2004.
2. CERT Coordination Center. CERT Advisory CA-2001-26 Nimda Worm. 2001.
3. CERT Coordination Center. Code Red II: Another Worm Exploiting Buffer Overflow In IIS Indexing Service DLL. Available at http://www.cert.org/incident_notes/IN-2001-09.html, 2001.
4. B. Cheswick. An evening with Berferd in which a cracker is lured, endured, and studied. In Proceedings of the Winter 1992 USENIX Conference: January 20 - January 24, 1992, San Francisco, California, pages 163-174, Berkeley, CA, USA, Winter 1992.
5. F. Cohen. A Short Course on Computer Viruses. John Wiley & Sons, 2nd edition, April 1994.
6. F. Cohen. The deception toolkit (DTK). http://www.all.net/dtk/dtk.html, June 2004.
7. E. Cooke, M. Bailey, Z. M. Mao, D. Watson, and F. Jahanian. Toward understanding distributed blackhole placement. In Proc of ACM CCS Workshop on Rapid Malcode, pages 54-64. ACM Press, October 2004.
8. M. Corporation. What you should know about the Sasser worm. http://www.microsoft.com/security/incident/sasser.mspx, May 2004.
9. S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff. A sense of self for Unix processes. In Proceedings of the IEEE Symposium on Research in Security and Privacy, pages 120-128, Oakland, CA, May 1996.
10. C. S. Inc. Netflow services and applications. 2002. http://www.cisco.com/warp/public/cc/pd/iosw/ioft/neflct/tech/napps_wp.htm.
11. D. Moore. Network telescopes: Observing small or distant security events. In 11th USENIX Security Symposium, Invited talk, San Francisco, CA, Aug. 5-9 2002. Unpublished.
12. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. Inside the Slammer worm. IEEE Security & Privacy, 1(4):33-39, 2003.
13. D. Moore, C. Shannon, G. M. Voelker, and S. Savage. Network telescopes. http://www.caida.org/outreach/papers/2004/tr-2004-04/, July 2004.
14. D. Moore, G. M. Voelker, and S. Savage. Inferring Internet denial-of-service activity. In Proceedings of the Tenth USENIX Security Symposium, pages 9-22, Washington, D.C., Aug. 13-17 2001.
15. J. Nazario. Defense and detection strategies against Internet worms. Artech, 2004.
16. J. Nazario, M. Bailey, and F. Jahanian. The spread of the Blaster worm. Submitted for publication.
17. R. Pang, V. Yegneswaran, P. Barford, V. Paxson, and L. Peterson. Characteristics of internet background radiation. http://www.cs.princeton.edu/nsg/papers/telescope.pdf, June 2004.
18. T. H. Project. Know Your Enemy: Passive Fingerprinting, Identifying remote hosts, without them knowing. 2002.
19. N. Provos. Honeyd - A virtual honeypot daemon. In 10th DFN-CERT Workshop, Hamburg, Germany, Feb. 2003.
20. SANS. Sans - Internet storm center - cooperative cyber threat monitor and alert system, June 2004.
21. C. Shannon and D. Moore. The spread of the Witty worm. http://www.caida.org/analysis/secuirty/witty/, June 2004.
22. D. Song, R. Malan, and R. Stone. A snapshot of global Internet worm activity. FIRST Conference on Computer Security Incident Handlin and Res onse 2002 June 2002
23. D. Song, R. Malan, and R. Stone. A snapshot of global Internet worm activity. Arbor Network Technical Report, June 2002.
24. L. Spitzner. Honeypots: Tracking Hackers. Addison-Wesley, 2002.
25. L. Spitzner et al. The honeynet project. http://project.honeynet.org/, June 2004.
26. S. Staniford, V. Paxson, and N. Weaver. How to 0wn the Internet in your spare time. In Proceedings of the 11th USENIX Security Symposium. USENIX, Aug. 2002.
27. W. R. Stevens. TCP/IP Illustrated, Volume 1: The Protocols. Addison Wesley, 1994.
28. J. Stewart. [full-disclosure] [fwd: [th-research] bagle remote uninstall]. http://lists.netsys.com/pipermail/full-disclosure/2004-January/015970.html, January 2004.
29. R. Stone. CenterTrack: An IP overlay network for tracking DoS floods, 2000.
30. Symantec. Security Response - W32.Beagle.A. http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle.a@mm.html, 2004.
31. I. Trend Micro. WORM AGOBOT.GEN - Description and solution. http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AGOBOT. GEN, 2003.
32. P. B. Vinod Yegneswaran and D. Plonka. On the design and use of Internet sinks for network abuse monitoring. In Recent Advances in Intrusion Detection-Proceedings of the 7th International Symposium (RAID 2004), Sophia Antipolis, French Riviera, France, Oct. 2004.
33. N. Weaver, V. Paxson, S. Staniford, and R. Cunningham. A Taxonomy of Computer Worms. In Proc of ACM CCS Workshop on Rapid Malcode, pages 11-18. ACM Press, October 2003.
34. V. Yegneswaran, P. Barford, and S. Jha. Global intrusion detection in the DOMINO overlay system. In Proceedings of Network and Distributed System Security Symposium (NDSS'04), San Diego, CA, February 2004.