Flexible and high-performance anonymization of NetFlow records using anontool

Foukarakis, Michalis; Antoniades, Demetris; Antonatos, Spiros; Markatos, Evangelos P.

doi:10.1109/seccom.2007.4550304

Cited by 17 publications

(7 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Work in data sanitization for computer and network logs to date has focused almost entirely upon development of tools [20,9,27,13,5,17] and anonymization algorithms [26], with little to no work doing any formal analysis of the effects of anonymization. This is an important aspect missing from the research body since without it, we just have a lot of tools to haphazardly anonymize data without knowing how to do it wisely or effectively.…”

Section: Related Workmentioning

confidence: 99%

“…The burgeoning field of data sanitization has helped address this tension by providing organizations, who wish to share their data, with new tools to anonymize computer and network logs [4,5,12,16,18,20,21,22,22,26,27]. However, little has been done to help users negotiate the difficult trade-off between the data owner's need for security and privacy, and the data analyst's need for high quality data-what is called the utility vs. security trade-off [20].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Evaluating the utility of anonymized network traces for intrusion detection

Lakkaraju

Slagell

2008

Proceedings of the 4th International Conference on Security and Privacy in Communication Netowrks

View full text Add to dashboard Cite

Recently, it has become increasingly important for computer security researchers and incident investigators to have access to larger and more diverse data sets. At the same time, trends towards protecting customer privacy have grown as a result of many embarrassing releases-of supposedly anonymous information-which has been traced back to individual computer users [7,15]. This has further increased reluctance of data owners to release large data sets to the research community or to share logs relevant to attacks from a common threat. The burgeoning field of data sanitization has helped alleviate some of these problems as it has recently provided many new tools for anonymizing sensitive data, but there is still a difficult trade-off to be negotiated between the data owner's need for privacy and security and the analyst's need for high utility data. Data sanitization policies must be created that are secure enough for the first party, but do not result in too much information loss to be usable to the second.Necessary to solving this problem of negotiating policies for data sanitization is the ability to analyze the effects of anonymization on both the security of the sanitized data and the utility left after anonymization. In this paper, we focus on analyzing the utility of network traces post-anonymization. Of course, any such measure of utility will naturally be subjective to the type of analysis being performed. So this work scopes the problem to utility for the task of attack detection. We employ a methodology we developed that analyzes the effect of anonymization on Intrusion Detection Systems (IDS), and we provide the first rigorous analysis of single field anonymization on IDS effectiveness. This work will begin to answer the questions of whether the field affects anonymization more than the algorithm; which fields have a larger impact on utility; and which anonymization algorithms have a larger impact on utility.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Evaluating the utility of anonymized network traces for intrusion detection

Lakkaraju

Slagell

2008

Proceedings of the 4th International Conference on Security and Privacy in Communication Netowrks

View full text Add to dashboard Cite

show abstract

“…In the context of anonymization of network traces, as surveyed in Reference [37], many solutions have been proposed [1][2][3][22][23][24][25][26][27][28][29]. In Figure 23, we have summarized the scope (e.g., accepted input data, anonymization fields, etc.)…”

Section: Related Workmentioning

confidence: 99%

A Multi-view Approach to Preserve Privacy and Utility in Network Trace Anonymization

Mohammady¹,

Oqaily²,

Wang³

et al. 2021

ACM Trans. Priv. Secur.

View full text Add to dashboard Cite

As network security monitoring grows more sophisticated, there is an increasing need for outsourcing such tasks to third-party analysts. However, organizations are usually reluctant to share their network traces due to privacy concerns over sensitive information, e.g., network and system configuration, which may potentially be exploited for attacks. In cases where data owners are convinced to share their network traces, the data are typically subjected to certain anonymization techniques, e.g., CryptoPAn, which replaces real IP addresses with prefix-preserving pseudonyms. However, most such techniques either are vulnerable to adversaries with prior knowledge about some network flows in the traces or require heavy data sanitization or perturbation, which may result in a significant loss of data utility. In this article, we aim to preserve both privacy and utility through shifting the trade-off from between privacy and utility to between privacy and computational cost. The key idea is for the analysts to generate and analyze multiple anonymized views of the original network traces: Those views are designed to be sufficiently indistinguishable even to adversaries armed with prior knowledge, which preserves the privacy, whereas one of the views will yield true analysis results privately retrieved by the data owner, which preserves the utility. We formally analyze the privacy of our solution and experimentally evaluate it using real network traces provided by a major ISP. The experimental results show that our approach can significantly reduce the level of information leakage (e.g., less than 1% of the information leaked by CryptoPAn) with comparable utility.

show abstract

“…This technique was implemented in the Crypto-PAn [5] tool. The Anontool allows perfield anonymization and provides various anonymization algorithms [6]. The FLAIM anonymization tool has an application program interface [4].…”

Section: Introductionmentioning

confidence: 99%

Anonym: A tool for anonymization of the Internet traffic

Farah

Trajković

2013

2013 IEEE International Conference on Cybernetics (CYBCO)

View full text Add to dashboard Cite

Abstract-Collecting network traffic traces from deployed networks is one of the basic steps in understanding communication networks. Traffic traces are used for network management, traffic engineering, packet classification, and analyzing user behavior to ensure adequate quality of service. Monitored traffic traces should be anonymized for privacy and security reasons. The goal of anonymization is to preserve trace properties while enforcing privacy policies. Various tools and techniques have been implemented for trace anonymization. In this paper, we propose and implement an anonymization tool that executes multilevel anonymization and displays analysis results. We describe architecture and features of the tool and discuss analysis of unanonymized and anonymized datasets.

show abstract

Flexible and high-performance anonymization of NetFlow records using anontool

Cited by 17 publications

References 8 publications

Evaluating the utility of anonymized network traces for intrusion detection

Evaluating the utility of anonymized network traces for intrusion detection

A Multi-view Approach to Preserve Privacy and Utility in Network Trace Anonymization

Anonym: A tool for anonymization of the Internet traffic

Contact Info

Product

Resources

About