Traffic Classification Using Visual Motifs: An Empirical Evaluation
|
|
|
- Madeline Norris
- 5 years ago
- Views:
Transcription
1 Traffic Classification Using Visual Motifs: An Empirical Evaluation Wilson Lian 1 Fabian Monrose 1 John McHugh 1,2 1 University of North Carolina at Chapel Hill 2 RedJack, LLC VizSec 2010
2 Overview Background Visual Motifs Traffic Classification Empirical Evaluation
3 Background Motivation Internet Network Administrator
4 Background Motivation d3b07384d113e... GET /index.ht... 7d8ad5cb9c d41d8cd98f00b... MAIL FROM: d41d8cd98f00b...
5 Background Goals Port 22 36fd6d8c3f5af4... Port 22 fc2394c1a Port 22 f4d6d8c3f5a36... Port c1a9fc... Port 5ad6d8c3ff Port 22 a92394c122fc... Port 25 MAIL FROM: Port 25 f c3ef... Port 25 ef c3f9... Port 25 DATA\r\nSubject: fo... Port 25 f c3ef... Port 80 b314caafaa3e... Port 80 b314caafaa3e... Port 80 POST /login.ph... Port 80 b314caafaa3e... Port 80 POST /AuthSv... Port 80 GET /index.ht... Port edec49eaa... Port f7b3db8f4f... Port 1214 aa3edec49e11... Port f006f7b3db8f0... Port e3edec4aa11... Port 1214 b8006f7b3d4ff0...
6 Background Assumptions Reliable transport via TCP Stream Cipher No access to payload Payload length preservation Encryption at or above Transport Layer
7 Visual Motifs Bigram Heatmaps C. Wright, F. Monrose, and G.M. Masson. Using visual motifs to classify encrypted traffic. 2006
8 Visual Motifs Heatmap Construction Client Server SYN 48 bytes SYN-ACK 48 bytes ACK 40 bytes HTTP Request 891 bytes 40 bytes 270 bytes 1500 bytes Time 40 bytes 1500 bytes 40 bytes
9 Visual Motifs Heatmap Construction Client Server SYN 48 bytes SYN-ACK 48 bytes ACK 40 bytes HTTP Request 891 bytes 40 bytes 270 bytes 1500 bytes 40 bytes 1500 bytes Time bytes
10 Visual Motifs Heatmap Construction Client Server SYN 48 bytes SYN-ACK 48 bytes ACK 40 bytes HTTP Request 891 bytes 40 bytes 270 bytes 1500 bytes 40 bytes 1500 bytes Time (48, -48) (-48, 40) (40, 891) (891, -40) (-40, -270) (-270, -1500) (-1500, 40) (40, -1500) (-1500, 40) 40 bytes
11 Visual Motifs Heatmap Construction Client Server SYN 48 bytes SYN-ACK 48 bytes ACK 40 bytes HTTP Request 891 bytes 40 bytes 270 bytes 1500 bytes 40 bytes 1500 bytes Time (48, -48) (-48, 40) (40, 891) (891, -40) (-40, -270) (-270, -1500) (-1500, 40) (40, -1500) (-1500, 40) 40 bytes
12 Visual Motifs Heatmap Construction Client Server SYN 48 bytes SYN-ACK 48 bytes ACK 40 bytes HTTP Request 891 bytes 40 bytes 270 bytes 1500 bytes 40 bytes 1500 bytes Time (48, -48) (-48, 40) (40, 891) (891, -40) (-40, -270) (-270, -1500) (-1500, 40) (40, -1500) (-1500, 40) 40 bytes
13 Visual Motifs Heatmap Construction (40, 891) (48, -48) (-48, 40) (40, 891) (891, -40) (-40, -270) (-270, -1500) (-1500, 40) (40, -1500) (-1500, 40)
14 Visual Motifs Heatmap Construction (-48, 40) (-1500, 40) (-1500, 40) (-40, -270) (-270, -1500) (40, 891) (40, 891) (48, -48) (891, -40) (40, -1500) (48, -48) (-48, 40) (40, 891) (891, -40) (-40, -270) (-270, -1500) (-1500, 40) (40, -1500) (-1500, 40)
15 Visual Motifs Heatmap Construction (-48, 40) 3/9 (-1500, = 33.3% 40) (-1500, 40) (-40, -270) 2/9 = 22.2% (-270, -1500) (40, 891) 1/9 (40, = 11.1% 891) (48, -48) 3/9 (891, = 33.3% -40) (40, -1500) (48, -48) (-48, 40) (40, 891) (891, -40) (-40, -270) (-270, -1500) (-1500, 40) (40, -1500) (-1500, 40)
16 Visual Motifs Heatmap Construction
17 Visual Motifs Bigram Heatmaps
18 Visual Motifs Modeling Protocol Behavior (-48, 40) 3/9 (-1500, = 33.3% 40) (-1500, 40) 1 (40, 891) 1/9 (40, = 11.1% 891) 2 (-40, -270) 2/9 = 22.2% (-270, -1500) (48, -48) 3/9 (891, = 33% -40) (40, -1500) 3 4
19 Visual Motifs Modeling Protocol Behavior Probability Bin
20 Traffic Classification Comparing Protocol Models Probability Bin
21 Traffic Classification Comparing Protocol Models Score = = Probability = Difference = = =.589
22 Traffic Classification Comparing Protocol Models Probability Bin
23 Traffic Classification Comparing Protocol Models 0.7 Score = = Probability Difference = = = =.072 5
24 Traffic Classification Classifying Samples 1 Create training models for desired protocols 2 Build testing model for network trace to be classified 3 Find training model with lowest L 1 distance L 1 (A, B) = n i=1 A φi A τ B φ i B τ
25 Traffic Classification Classification Confidence Threshold Goal: Eliminate close calls Require 1st place candidate to lead 2nd place by certain amount to make decision Based on standard deviation of L 1 distances
26 Empirical Evaluation Evaluation Parameter Selection Bin size Confidence threshold Training set size Precision Recall true positives true positives + false positives true positives true positives + false negatives
27 Empirical Evaluation Evaluation Trial := 1 Randomly sample some percentage of available data for each port and train classifier 2 Randomly sample some number (λ = 45, 000) of the remaining data points for each port and create testing samples 3 Classify testing samples 50 Trials Training Data Testing Data
28 Empirical Evaluation dartmouth Dataset Weekdays: January 19, 2004 February 6, 2004 Top 10 ports by number of sessions observed 25 (SMTP), 80 (HTTP), 88 (Kerberos), 110 (POP3), 135 (DCE), 139 (NetBIOS), 443 (HTTPS), 445 (MDS), 902 (VMware), 1214 (Kazaa) No payload data Used for parameter selection Total Packets 1.3 Billion Traffic Volume 707 GB Observed Ports 64,214 Sessions 5.2 Million
29 Empirical Evaluation darpa Data 1999 DARPA Intrusion Detection Evaluation Weeks 1, 3, 4, 5 Ports 21 (FTP), 23 (Telnet), 25 (SMTP), 79 (finger), 80 (HTTP), 110 (POP3) Additional cross-validation using parameter values determined from dartmouth. Total Packets 60 Million Traffic Volume 12 GB Observed Ports 10,274 Sessions 1.6 Million
30 Empirical Evaluation dartmouth Results 50 Trials 15% Training Set Size 45,000 Data Points Testing Set Size k = 0.75 Confidence Threshold
31 Empirical Evaluation dartmouth Results
32 Empirical Evaluation dartmouth Results Server Message Block (SMB) protocol Used for Windows resource sharing Windows NT: via NetBIOS (NBT) on TCP 139 Windows 2000: directly on TCP 445 Clients with NetBIOS enabled try connections on TCP 139 and TCP 445 Reference:
33 Empirical Evaluation darpa Results 50 Trials 15% Training Set Size 45,000 Data Points Testing Set Size k = 0.75 Confidence Threshold
34 Empirical Evaluation Inter-dataset Analysis 50 Trials 15% Training Set Size (dartmouth) 45,000 Data Points Testing Set Size (darpa) k = 0.25 Confidence Threshold
35 Empirical Evaluation Inter-dataset Analysis
36 Empirical Evaluation Inter-dataset Analysis Mailbomb attack?
37 Empirical Evaluation Inter-dataset Analysis
38 Limitations Must be trained on network to be tested Reliance on session de-multiplexing TCP only Deliberate attempts to disguise traffic (Folga et al., Wright et al. 2009)
39 Future Work On-line classification Protocol subcategorization (e.g., SSH interactive vs. SCP file transfer)
40 Conclusion Modeling protocol behavior using only packet size, direction, and order Resistant to encryption High precision and recall Quick and reliable traffic inspection Useful for anomaly and misuse detection
41 Questions? Thanks for listening. Q & A wwlian@gmail.com
Using Visual Motifs to Classify Encrypted Traffic
Using Visual Motifs to Classify Encrypted Traffic VizSEC'06 - November 3, 2006 Charles V Wright Fabian Monrose Gerald M Masson Johns Hopkins University Information Security Institute Traffic Classification:
SVILUPPO DI UNA TECNICA DI RICONOSCIMENTO STATISTICO DI APPLICAZIONI SU RETE IP
UNIVERSITÀ DEGLI STUDI DI PARMA FACOLTÀ di INGEGNERIA Corso di Laurea Specialistica in Ingegneria delle Telecomunicazioni SVILUPPO DI UNA TECNICA DI RICONOSCIMENTO STATISTICO DI APPLICAZIONI SU RETE IP
Packet Classification in Co-mingled Traffic Streams
Packet Classification in Co-mingled Traffic Streams Siddharth Maru, Timothy X Brown Dept. of Electrical, Computer and Energy Engineering University of Colorado at Boulder, CO 80309-0530 {siddharth.maru,timxb}@colorado.edu
Lab 4: Network Packet Capture and Analysis using Wireshark
Lab 4: Network Packet Capture and Analysis using Wireshark 4.1 Details Aim: To provide a foundation in network packet capture and analysis. You may be faced with network traffic analysis, from traffic
4. The transport layer
4.1 The port number One of the most important information contained in the header of a segment are the destination and the source port numbers. The port numbers are necessary to identify the application
Intrusion Detection System (IDS) IT443 Network Security Administration Slides courtesy of Bo Sheng
Intrusion Detection System (IDS) IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Internet Security Mechanisms Prevent: Firewall, IPsec, SSL Detect: Intrusion Detection Survive/ Response:
Anomaly Detection in Communication Networks
Anomaly Detection in Communication Networks Prof. D. J. Parish High Speed networks Group Department of Electronic and Electrical Engineering D.J.Parish@lboro.ac.uk Loughborough University Overview u u
Automated Traffic Classification and Application Identification using Machine Learning. Sebastian Zander, Thuy Nguyen, Grenville Armitage
Automated Traffic Classification and Application Identification using Machine Learning Sebastian Zander, Thuy Nguyen, Grenville Armitage {szander,tnguyen,garmitage}@swin.edu.au Centre for Advanced Internet
OSI Transport Layer. objectives
LECTURE 5 OSI Transport Layer objectives 1. Roles of the Transport Layer 1. segmentation of data 2. error detection 3. Multiplexing of upper layer application using port numbers 2. The TCP protocol Communicating
Toward Efficient Querying of Compressed Network Payloads!
Toward Efficient Querying of Compressed Network Payloads By Teryl Taylor and Fabian Monrose University of North Carolina at Chapel Hill Scott E. Coull and John McHugh RedJack Motivation Get /BadExe Please
Developing the Sensor Capability in Cyber Security
Developing the Sensor Capability in Cyber Security Tero Kokkonen, Ph.D. +358504385317 tero.kokkonen@jamk.fi JYVSECTEC JYVSECTEC - Jyväskylä Security Technology - is the cyber security research, development
CSC Network Security
CSC 474 -- Security Topic 9. Firewalls CSC 474 Dr. Peng Ning 1 Outline Overview of Firewalls Filtering Firewalls Proxy Servers CSC 474 Dr. Peng Ning 2 Overview of Firewalls CSC 474 Dr. Peng Ning 3 1 Internet
ch02 True/False Indicate whether the statement is true or false.
ch02 True/False Indicate whether the statement is true or false. 1. No matter what medium connects computers on a network copper wires, fiber-optic cables, or a wireless setup the same protocol must be
Layer 4: UDP, TCP, and others. based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers
Layer 4: UDP, TCP, and others based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers Concepts application set transport set High-level, "Application Set" protocols deal only with how handled
Network Review TEJ4M. SBrace
Network Review TEJ4M SBrace Example of how the OSI Layers work using an e-mail sent from the computer on the left. Email sent from John: Meet me at Carl s 1:30 John Identify sender and intended receiver;
Linux Networking: tcp. TCP context and interfaces
Linux Networking: tcp David Morgan TCP context and interfaces Computer A Computer B application process application process data data data data TCP process TCP process a network 1 TCP purposes and features
A Hybrid Approach for Accurate Application Traffic Identification
A Hybrid Approach for Accurate Application Traffic Identification Thesis Defence December 21, 2005 Young J. Won yjwon@postech.ac.kr Distributed Processing & Network Management Lab. Dept. of Computer Science
Network Technology 1 5th - Transport Protocol. Mario Lombardo -
Network Technology 1 5th - Transport Protocol Mario Lombardo - lombardo@informatik.dhbw-stuttgart.de 1 overview Transport Protocol Layer realizes process to process communication data unit is called a
Early Application Identification
Early Application Identification Laurent Bernaille Renata Teixeira Kave Salamatian Université Pierre et Marie Curie - LIP6/CNRS Which applications run on my network? Internet Edge Network (campus, enterprise)
Fundamentals of Computer Networking AE6382
Computer networks are an integral part of the modern computing infrastructure The local network (LAN) is usually Ethernet LAN s are inter-connected with other LAN s in a hierarchical fashion eventually
Polygraph: Automatically Generating Signatures for Polymorphic Worms
Polygraph: Automatically Generating Signatures for Polymorphic Worms James Newsome Brad Karp Dawn Song Presented by: Jeffrey Kirby Overview Motivation Polygraph Signature Generation Algorithm Evaluation
NT1210 Introduction to Networking. Unit 10
NT1210 Introduction to Networking Unit 10 Chapter 10, TCP/IP Transport Objectives Identify the major needs and stakeholders for computer networks and network applications. Compare and contrast the OSI
Firewall Simulation COMP620
Firewall Simulation COMP620 Firewall Simulation The simulation allows participants to configure their own simulated firewalls using Cisco-like syntax. Participants can take benign or malicious actions
Enhancing Byte-Level Network Intrusion Detection Signatures with Context
Enhancing Byte-Level Network Intrusion Detection Signatures with Context Robin Sommer sommer@in.tum.de Technische Universität München Germany Vern Paxson vern@icir.org International Computer Science Institute
A Non-Parametric Approach to Generation and Validation of Synthetic Network Traffic
The UNIVERSITY of NORTH CAROLINA at CHAPEL HILL A Non-Parametric Approach to Generation and Validation of Synthetic Network Traffic Félix Hernández-Campos ndez-campos Kevin Jeffay Don Smith Department
Can we trust the inter-packet time for traffic classification?
Can we trust the inter-packet time for traffic classification? Mohamad Jaber, Roberto G. Cascella and Chadi Barakat INRIA Sophia Antipolis, EPI Planète 2004, Route des Luciolles Sophia Antipolis, France
Exposing server performance to network managers through passive network measurements
Exposing server performance to network managers through passive network measurements Jeff Terrell Dept. of Computer Science University of North Carolina at Chapel Hill October 19, 2008 1 databases web
Improved Detection of Low-Profile Probes and Denial-of-Service Attacks*
Improved Detection of Low-Profile Probes and Denial-of-Service Attacks* William W. Streilein Rob K. Cunningham, Seth E. Webster Workshop on Statistical and Machine Learning Techniques in Computer Intrusion
Means for Intrusion Detection. Intrusion Detection. INFO404 - Lecture 13. Content
Intrusion Detection INFO404 - Lecture 13 21.04.2009 nfoukia@infoscience.otago.ac.nz Content Definition Network vs. Host IDS Misuse vs. Behavior Based IDS Means for Intrusion Detection Definitions (1) Intrusion:
Automated Application Signature Generation Using LASER and Cosine Similarity
Automated Application Signature Generation Using LASER and Cosine Similarity Byungchul Park, Jae Yoon Jung, John Strassner *, and James Won-ki Hong * {fates, dejavu94, johns, jwkhong}@postech.ac.kr Dept.
Flowzilla: A Methodology for Detecting Data Transfer Anomalies in Research Networks. Anna Giannakou, Daniel Gunter, Sean Peisert
Flowzilla: A Methodology for Detecting Data Transfer Anomalies in Research Networks Anna Giannakou, Daniel Gunter, Sean Peisert Research Networks Scientific applications that process large amounts of data
AIT 682: Network and Systems Security
AIT 682: Network and Systems Security Final Exam Review Instructor: Dr. Kun Sun Topics covered by Final Topic before Midterm 10% Topic after Midterm 90% Date: 12/13/2017 7:30am 10:15am Place: the same
Hands-On Ethical Hacking and Network Defense
Hands-On Ethical Hacking and Network Defense Chapter 2 TCP/IP Concepts Review Last modified 1-11-17 Objectives Describe the TCP/IP protocol stack Explain the basic concepts of IP addressing Explain the
Heuristics to Classify Internet Backbone Traffic based on Connection Patterns
Heuristics to Classify Internet Backbone Traffic based on Connection Patterns Wolfgang John and Sven Tafvelin Department of Computer Science and Engieneering Chalmers University of Technolgy Göteborg,
Tracking the Evolution of Web Traffic:
The University of North Carolina at Chapel Hill Department of Computer Science 11 th ACM/IEEE International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication Systems (MASCOTS)
Mapping Internet Sensors with Probe Response Attacks
Mapping Internet Sensors with Probe Response Attacks John Bethencourt, Jason Franklin, and Mary Vernon {bethenco, jfrankli, vernon}@cs.wisc.edu Computer Sciences Department University of Wisconsin, Madison
CCNA 1 Chapter 7 v5.0 Exam Answers 2013
CCNA 1 Chapter 7 v5.0 Exam Answers 2013 1 A PC is downloading a large file from a server. The TCP window is 1000 bytes. The server is sending the file using 100-byte segments. How many segments will the
Using Visual Motifs to Classify Encrypted Traffic
Using Visual Motifs to Classify Encrypted Traffic Charles V Wright cvwright@jhu.edu Fabian Monrose fabian@jhu.edu Gerald M Masson masson@jhu.edu Johns Hopkins University Information Security Institute
Revealing Skype Traffic: When Randomness Plays with You
Revealing Skype Traffic: When Randomness Plays with You Dario Bonfiglio Marco Mellia Michela Meo Dario Rossi Paolo Tofanelli Our Goal Identify Skype traffic Motivations Operators need to know what is running
TRANSMISSION CONTROL PROTOCOL. ETI 2506 TELECOMMUNICATION SYSTEMS Monday, 7 November 2016
TRANSMISSION CONTROL PROTOCOL ETI 2506 TELECOMMUNICATION SYSTEMS Monday, 7 November 2016 ETI 2506 - TELECOMMUNICATION SYLLABUS Principles of Telecom (IP Telephony and IP TV) - Key Issues to remember 1.
Configuring Health Monitoring
CHAPTER1 This chapter describes how to configure health monitoring on the ACE to track the state of a server by sending out probes. Also referred to as out-of-band health monitoring, the ACE verifies the
Tunneling Activities Detection Using Machine Learning Techniques
Fabien Allard 1, Renaud Dubois 1, Paul Gompel 2 and Mathieu Morel 3 1 Thales Communications 160 Boulevard de Valmy BP 82 92704 Colombes Cedex FRANCE firstname.lastname@fr.thalesgroup.com 2 pgompel@gmail.com
Mapping Internet Sensors with Probe Response Attacks
Mapping Internet Sensors with Probe Response Attacks Computer Sciences Department University of Wisconsin, Madison Introduction Outline Background Example Attack Introduction to the Attack Basic Probe
Distributed Systems. 27. Firewalls and Virtual Private Networks Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 27. Firewalls and Virtual Private Networks Paul Krzyzanowski Rutgers University Fall 2013 November 25, 2013 2013 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive
UDP, TCP, IP multicast
UDP, TCP, IP multicast Dan Williams In this lecture UDP (user datagram protocol) Unreliable, packet-based TCP (transmission control protocol) Reliable, connection oriented, stream-based IP multicast Process-to-Process
HMM Profiles for Network Traffic Classification (Extended Abstract)
HMM Profiles for Network Traffic Classification (Extended Abstract) Charles Wright Johns Hopkins University Information Security Institute cwright@cs.jhu.edu Fabian Monrose Johns Hopkins University Information
Data and Computer Communications. Chapter 2 Protocol Architecture, TCP/IP, and Internet-Based Applications
Data and Computer Communications Chapter 2 Protocol Architecture, TCP/IP, and Internet-Based s 1 Need For Protocol Architecture data exchange can involve complex procedures better if task broken into subtasks
Introduction to Networking
Introduction to Networking Chapters 1 and 2 Outline Computer Network Fundamentals Defining a Network Networks Defined by Geography Networks Defined by Topology Networks Defined by Resource Location OSI
Application Layer Preprocessors
The following topics explain application layer preprocessors and how to configure them: Introduction to, page 1 The DCE/RPC Preprocessor, page 2 The DNS Preprocessor, page 12 The FTP/Telnet Decoder, page
Operating Systems and. Computer Networks. Introduction to Computer Networks. Operating Systems and
Computer Networks Introduction to Computer Networks Linux System Structure Corbet et al, Linux Device Drivers, O Reilly, 2005 Categories of System Calls Process Control load, execute, end, abort, create
TELNET is short for Terminal Network Enables the establishment of a connection to a remote system, so that the local terminal appears to be the
Telnet/SSH TELNET is short for Terminal Network Enables the establishment of a connection to a remote system, so that the local terminal appears to be the terminal at the remote location. Usually establishes
SE 4C03 Winter Final Examination Answer Key. Instructor: William M. Farmer
SE 4C03 Winter 2003 Final Examination Answer Key Instructor: William M. Farmer (1) [2 pts.] Both the source and destination IP addresses are used to route IP datagrams. Is this statement true or false?
Activating Intrusion Prevention Service
Activating Intrusion Prevention Service Intrusion Prevention Service Overview Configuring Intrusion Prevention Service Intrusion Prevention Service Overview Intrusion Prevention Service (IPS) delivers
Security Engineering. Lecture 16 Network Security Fabio Massacci (with the courtesy of W. Stallings)
Security Lecture 16 Network Security Fabio Massacci (with the courtesy of W. Stallings) Lecture Outline Network Attacks Attive Attacks Passive Attacks TCP Attacks Contermeasures IPSec SSL/TLS Firewalls
Meeting 39. Guest Speaker Dr. Williams CEH Networking
Cyber@UC Meeting 39 Guest Speaker Dr. Williams CEH Networking If You re New! Join our Slack ucyber.slack.com Feel free to get involved with one of our committees: Content, Finance, Public Affairs, Outreach,
Managing SonicWall Gateway Anti Virus Service
Managing SonicWall Gateway Anti Virus Service SonicWall Gateway Anti-Virus (GAV) delivers real-time virus protection directly on the SonicWall security appliance by using SonicWall s IPS-Deep Packet Inspection
Hands-On Activity. Firewall Simulation. Simulated Network. Firewall Simulation 3/19/2010. On Friday, February 26, we will be meeting in
Hands-On Activity Firewall Simulation COMP620 On Friday, February 26, we will be meeting in the Graham 212 lab to participate in a firewall configuration simulation. This simulator was written by Dr. Williams
FPGA based Network Traffic Analysis using Traffic Dispersion Graphs
FPGA based Network Traffic Analysis using Traffic Dispersion Graphs 2 nd September, 2010 Faisal N. Khan, P. O. Box 808, Livermore, CA 94551 This work performed under the auspices of the U.S. Department
a. the physical layer, b. and the data-link layer. a. three physical layers, b. three data-link layers, c. and only one network layer.
CHAPTER PRACTICE SET Questions Q-. Q-. To make the communication bidirectional, each layer needs to be able to provide two opposite tasks, one in each direction. The link-layer switch is normally involved
6. The Transport Layer and protocols
6. The Transport Layer and protocols 1 Dr.Z.Sun Outline Transport layer services Transmission Control Protocol Connection set-up and tear-down Ports and Well-know-ports Flow control and Congestion control
(2½ hours) Total Marks: 75
(2½ hours) Total Marks: 75 N. B.: (1) All questions are compulsory. (2) Makesuitable assumptions wherever necessary and state the assumptions made. (3) Answers to the same question must be written together.
Protecting Network Quality of Service Against Denial of Service Attacks
Protecting Network Quality of Service Against Denial of Service Attacks Douglas S. Reeves Peter Wurman NC State University S. Felix Wu U.C. Davis Dan Stevenson Xiaoyong Wu MCNC DARPA FTN PI Meeting January
Intrusion Detection System
Intrusion Detection System Time Machine Dynamic Application Detection 1 NIDS: Two generic problems Attack identified But what happened in the past??? Application identification Only by port number! Yet
Applied IT Security. System Security. Dr. Stephan Spitz 6 Firewalls & IDS. Applied IT Security, Dr.
Applied IT Security System Security Dr. Stephan Spitz Stephan.Spitz@de.gi-de.com Overview & Basics System Security Network Protocols and the Internet Operating Systems and Applications Operating System
A TWO LEVEL ARCHITECTURE USING CONSENSUS METHOD FOR GLOBAL DECISION MAKING AGAINST DDoS ATTACKS
ISSN: 2229-6948 (ONLINE) ICTACT JOURNAL OF COMMUNICATION TECHNOLOGY, JUNE 2010, VOLUME: 01, ISSUE: 02 DOI: 10.21917/ijct.2010.0013 A TWO LEVEL ARCHITECTURE USING CONSENSUS METHOD FOR GLOBAL DECISION MAKING
Computer and Network Security
Computer and Network Security c Copyright 2000 R. E. Newman Computer & Information Sciences & Engineering University Of Florida Gainesville, Florida 32611-6120 nemo@cise.ufl.edu Network Security (Pfleeger
Computer and Network Security
CIS 551 / TCOM 401 Computer and Network Security Spring 2009 Lecture 8 Announcements Plan for Today: Networks: TCP Firewalls Midterm 1: One week from Today! 2/17/2009 In class, short answer, multiple choice,
Inferring the Source of Encrypted HTTP Connections
Inferring the Source of Encrypted HTTP Connections Marc Liberatore Brian Neil Levine 1 Private Communications? Does link encryption provide privacy? VPNs, SSH tunnels, WEP/WPA, etc. 2 Anonymous Communication?
Classification of Log Files with Limited Labeled Data
Classification of Log Files with Limited Labeled Data Stefan Hommes, Radu State, Thomas Engel University of Luxembourg 15.10.2013 1 Motivation Firewall log files store all accepted and dropped connections.
Objectives: (1) To learn to capture and analyze packets using wireshark. (2) To learn how protocols and layering are represented in packets.
Team Project 1 Due: Beijing 00:01, Friday Nov 7 Language: English Turn-in (via email) a.pdf file. Objectives: (1) To learn to capture and analyze packets using wireshark. (2) To learn how protocols and
Our Narrow Focus Computer Networking Security Vulnerabilities. Outline Part II
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2016 www.cs.cmu.edu/~prs/15-441-f16 Yes: Creating a secure channel for communication (Part I) Protecting
OSSIM Fast Guide
----------------- OSSIM Fast Guide ----------------- February 8, 2004 Julio Casal http://www.ossim.net WHAT IS OSSIM? In three phrases: - VERIFICATION may be OSSIM s most valuable contribution
Intrusion Detection and Malware Analysis
Intrusion Detection and Malware Analysis Anomaly-based IDS Pavel Laskov Wilhelm Schickard Institute for Computer Science Taxonomy of anomaly-based IDS Features: Packet headers Byte streams Syntactic events
The Bro Network Intrusion Detection System
The Bro Network Intrusion Detection System Robin Sommer Lawrence Berkeley National Laboratory rsommer@lbl.gov http://www.icir.org Outline Design of the Bro NIDS Philosophy Architecture LBNL s Bro Installation
Scanning. Course Learning Outcomes for Unit III. Reading Assignment. Unit Lesson UNIT III STUDY GUIDE
UNIT III STUDY GUIDE Course Learning Outcomes for Unit III Upon completion of this unit, students should be able to: 1. Recall the terms port scanning, network scanning, and vulnerability scanning. 2.
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 12
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 12 Announcements Project 2 is on the web. Due: March 15th Send groups to Jeff Vaughan (vaughan2@seas) by Thurs. Feb. 22nd. Plan for
9th Slide Set Computer Networks
Prof. Dr. Christian Baun 9th Slide Set Computer Networks Frankfurt University of Applied Sciences WS1718 1/49 9th Slide Set Computer Networks Prof. Dr. Christian Baun Frankfurt University of Applied Sciences
Configuring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
Overview Intrusion Detection Systems and Practices
Overview Intrusion Detection Systems and Practices Chapter 13 Lecturer: Pei-yih Ting Intrusion Detection Concepts Dealing with Intruders Detecting Intruders Principles of Intrusions and IDS The IDS Taxonomy
QUESTION BANK EVEN SEMESTER
Fatima Michael College of Engineering and Technology DEPARTMENT OF ELECTRONICS AND COMMUNICATION ENGINEERING QUESTION BANK EVEN SEMESTER SUB CODE & NAME: EC2352 COMPUTER NETWORKS YEAR / SEM: III / VI Staff
Transport Layer (TCP/UDP)
Transport Layer (TCP/UDP) Where we are in the Course Moving on up to the Transport Layer! Application Transport Network Link Physical CSE 461 University of Washington 2 Recall Transport layer provides
Internet Traffic Classification using Machine Learning
Internet Traffic Classification using Machine Learning by Alina Lapina 2018, UiO, INF5050 Alina Lapina, Master student at IFI, Full stack developer at Ciber Experis 2 Based on Thuy T. T. Nguyen, Grenville
Generalization of Signatures for SSH Encrypted Traffic Identification
Generalization of Signatures for SSH Encrypted Traffic Identification Riyad Alshammari and A. Nur Zincir-Heywood Faculty of Computer Science, Dalhousie University 6050 University Avenue Halifax, NS, Canada
Router and ACL ACL Filter traffic ACL: The Three Ps One ACL per protocol One ACL per direction One ACL per interface
CCNA4 Chapter 5 * Router and ACL By default, a router does not have any ACLs configured and therefore does not filter traffic. Traffic that enters the router is routed according to the routing table. *
Internet and Intranet Protocols and Applications
Internet and Intranet Protocols and Applications Lecture 1b: The Transport Layer in the Internet January 17, 2006 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu 01/17/06
Transport Layer Security
CEN585 Computer and Network Security Transport Layer Security Dr. Mostafa Dahshan Department of Computer Engineering College of Computer and Information Sciences King Saud University mdahshan@ksu.edu.sa
Defining Networks with the OSI Model. Module 2
Defining Networks with the OSI Model Module 2 Objectives Skills Concepts Objective Domain Description Objective Domain Number Understanding OSI Basics Defining the Communications Subnetwork Defining the
CSCI 466 Midterm Networks Fall 2013
CSCI 466 Midterm Networks Fall 2013 Name: This exam consists of 6 problems on the following 7 pages. You may use your single-sided hand-written 8 ½ x 11 note sheet and a calculator during the exam. No
Configuring Anomaly Detection
CHAPTER 9 Caution Anomaly detection assumes it gets traffic from both directions. If the sensor is configured to see only one direction of traffic, you should turn off anomaly detection. Otherwise, when
Chapter 7. Local Area Network Communications Protocols
Chapter 7 Local Area Network Communications Protocols The Network Layer The third layer of the OSI Model is the network layer. The network layer is concerned with providing a means for hosts to communicate
QUESTION BANK UNIT-I
DEPARTMENT OF INFORMATION TECHNOLOGY QUESTION BANK Subject Code: CS1302 Subject Name: Computer Networks Year/ Sem: III / V UNIT-I 1. What is multicast? What is the difference between unicast and multicast?
Basic Concepts in Intrusion Detection
Technology Technical Information Services Security Engineering Roma, L Università Roma Tor Vergata, 23 Aprile 2007 Basic Concepts in Intrusion Detection JOVAN GOLIĆ Outline 2 Introduction Classification
Configuring Anomaly Detection
CHAPTER 9 This chapter describes anomaly detection and its features and how to configure them. It contains the following topics: Understanding Security Policies, page 9-2 Understanding Anomaly Detection,
Overview of Firewalls. CSC 474 Network Security. Outline. Firewalls. Intrusion Detection System (IDS)
CSC 474 Network Security Topic 8.4 Firewalls and Intrusion Detection Systems (IDS) 1 Outline Firewalls Filtering firewalls Proxy firewalls Intrusion Detection System (IDS) Rule-based IDS Anomaly detection
Detecting Spammers with SNARE: Spatio-temporal Network-level Automatic Reputation Engine
Detecting Spammers with SNARE: Spatio-temporal Network-level Automatic Reputation Engine Shuang Hao, Nadeem Ahmed Syed, Nick Feamster, Alexander G. Gray, Sven Krasser Motivation Spam: More than Just a
Advanced Security and Mobile Networks
WJ Buchanan. ASMN (1) Advanced Security and Mobile Networks Unit 1: Network Security Application Presentation Session Transport Network Data Link Physical OSI Application Transport Internet Internet model
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
Graph-based Detection of Anomalous Network Traffic
Graph-based Detection of Anomalous Network Traffic Do Quoc Le Supervisor: Prof. James Won-Ki Hong Distributed Processing & Network Management Lab Division of IT Convergence Engineering POSTECH, Korea lequocdo@postech.ac.kr
From Traffic Measurement to Realistic Workload Generation
From Traffic Measurement to Realistic Workload Generation Felix Hernandez-Campos Ph. D. Candidate Dept. of Computer Science Univ. of North Carolina at Chapel Hill Joint work with F. Donelson Smith and
CSE 3214: Computer Network Protocols and Applications. Midterm Examination
Department of Computer Science and Engineering CSE 3214: Computer Network Protocols and Applications Midterm Examination Instructions: Instructor: Peter Lian Date: February 14, 2013 1. Examination time: