Enriching Network Security Analysis with Time Travel Gregor Maier TU Berlin / DT Labs Robin Sommer ICSI / LBNL Holger Dreger Siemens AG Corporate Technology Anja Feldmann TU Berlin / DT Labs Vern Paxson ICSI / UC Berkeley Fabian Schneider TU Berlin / DT Labs ABSTRACT In many situations it can be enormously helpful to archive the raw contents of a network traf c stream to disk, to enable later inspection of activity that becomes interesting only in retrospect. We present a Time Machine (TM) for network traf c that provides such a capability. The TM leverages the heavy-tailed nature of network ows to capture nearly all of the likely-interesting traf c while storing only a small fraction of the total volume. An initial proof-of-principle prototype established the forensic value of such an approach, contributing to the investigation of numerous attacks at a site with thousands of users. Based on these experiences, a rearchitected implementation of the system provides exible, highperformance traf c stream capture, indexing and retrieval, including an interface between the TM and a real-time network intrusion detection system (NIDS). The NIDS controls the TM by dynamically adjusting recording parameters, instructing it to permanently store suspicious
End of preview. The entire article is 12 pages. To view the full-text, please rent this article to continue.
/lp/association-for-computing-machinery/enriching-network-security-analysis-with-time-travel-GeJwWo0mNZ
Welcome to DeepDyve! Rent Premier Research Articles and Save Up to 90%
Enriching network security analysis with time travel
Maier, Gregor; Sommer, Robin; Dreger, Holger; Feldmann, Anja; Paxson, Vern; Schneider, Fabian
Follow ACM SIGCOMM Computer Communication Review
, Volume 38 (4)
Association for Computing Machinery – Oct 1, 2008
More Info
More Like This Article
View All dataSource[]=actageo&dataSource[]=aspet&dataSource[]=aaos&dataSource[]=aacc&dataSource[]=aacr&dataSource[]=aea&dataSource[]=aip&dataSource[]=ajnr&dataSource[]=ams&dataSource[]=aps_physical&dataSource[]=appi_book&dataSource[]=appi_journal&dataSource[]=apha&dataSource[]=asip&dataSource[]=asm&dataSource[]=asn&dataSource[]=aspb&dataSource[]=avs&dataSource[]=annual_reviews&dataSource[]=arxiv&dataSource[]=acm&dataSource[]=berghahn&dataSource[]=cabi&dataSource[]=clinical_trials&dataSource[]=dailymed&dataSource[]=degruyter&dataSource[]=du_press&dataSource[]=esa&dataSource[]=eu_press&dataSource[]=elsevier&dataSource[]=emerald&dataSource[]=ejtr&dataSource[]=emea&dataSource[]=epo&dataSource[]=faseb&dataSource[]=gsa&dataSource[]=health_affairs&dataSource[]=hindawi&dataSource[]=imanager&dataSource[]=imedpub&dataSource[]=informa_healthcare&dataSource[]=informs&dataSource[]=iop&dataSource[]=iucr&dataSource[]=iospress&dataSource[]=jbjs&dataSource[]=leftcoast&dataSource[]=lu_press&dataSource[]=mesharpe&dataSource[]=mary_ann_liebert&dataSource[]=medline&dataSource[]=mit_press&dataSource[]=nature&dataSource[]=oxford&dataSource[]=pier_professional&dataSource[]=pnas&dataSource[]=portlandpress&dataSource[]=psyc_articles&dataSource[]=psyc_books&dataSource[]=psyc_critiques&dataSource[]=plos_journal&dataSource[]=pubmed_central&dataSource[]=rsna&dataSource[]=rockefeller&dataSource[]=rcn&dataSource[]=ria&dataSource[]=rsc&dataSource[]=sage&dataSource[]=spie&dataSource[]=springer_journal&dataSource[]=springer&dataSource[]=taylor_francis&dataSource[]=aps&dataSource[]=the_scientist&dataSource[]=uc_press&dataSource[]=uspto_abstract&dataSource[]=wiley&dataSource[]=pct
© 2012 DeepDyve, Inc. All rights reserved.
Terms of Service | Privacy Policy
