Network Profiling: Content Analysis of Users Behavior in Digital Communication Channel

Colombini, Clara Maria; Colella, Antonio; Mattiucci, Marco; Castiglione, Aniello

doi:10.1007/978-3-642-32498-7_31

Cited by 8 publications

(3 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…every attack is specially customized to the characteristics of the systems to hit, with the aim to reach a specific advantage; the implementation of the attack will be different for each attack; the impact of the caused damage is publicly revealed with a lag: as with all crimes, the victim is not willing to reveal his vulnerability; source and path are difficult to find, because their authors can take advantage of the anonymity offered by the cyberspace; it is often used as part of a larger conventional attack in support of it within a conflict, to gain more advantage over the enemy [12].…”

Section: Threat Analysismentioning

confidence: 99%

Amplification DDoS Attacks: Emerging Threats and Defense Strategies

Colella¹,

Colombini

2014

Advanced Information Systems Engineering

Self Cite

View full text Add to dashboard Cite

Part 2: 4th International Workshop on Security and Cognitive Informatics for Homeland Defense (SeCIHD 2014)International audienceThere are too many servers on the Internet that have already been used, or that are vulnerable and can potentially be used to launch DDoS attacks. Even though awareness increases and organizations begin to lock down those systems, there are plenty of other protocols that can be exploited to be used instead of them. One example is the Simple Network Management Protocol (SNMP), which is a common UDP protocol used for network management. Several types of network devices actually come with SNMP ”on” by default. A request sent to an SNMP server returns a response that is larger than the query that came in.The main aim of this paper is to investigate on the increasing prevalence and destructive power of amplification-based distributed denial of service (DDoS) attacks in order to present a solution based on a profiling methodology. The paper encompass three aspects: amplification DDoS attacks and main port used, the profiling methodology as a mean of identifying the threat and shape it. Finally, a proposal solution is given by considering both strategic and technical aspects

show abstract

Section: Threat Analysismentioning

confidence: 99%

Amplification DDoS Attacks: Emerging Threats and Defense Strategies

Colella¹,

Colombini

2014

Advanced Information Systems Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…For instance the well known concept of media write-blocking during the acquisition cannot be applied to network forensics. Moreover the availability of high speed networks, the widespread of mobile devices or smart phones [7], [8], the growing use of OSN and online services [9] lead us to believe that an increasing number of relevant digital evidence will be available on the network [10], [11].…”

Section: Introductionmentioning

confidence: 99%

Forensically-Sound Methods to Collect Live Network Evidence

Castiglione

Cattaneo

Maio

et al. 2013

2013 IEEE 27th International Conference on Advanced Information Networking and Applications (AINA)

View full text Add to dashboard Cite

In the last decade Digital Forensics has experienced several issues when dealing with network evidence. An analyst, which is in charge of managing evidence flowing over a network have to face problems due to the volatile nature of such information. In facts, such data may change over time, may be lying on a server out of the his jurisdiction, or geographically far from where the crime was committed.In this paper two methods to allow remote collection of network evidence produced by online services such as web pages, chats, documents, photos and videos are presented. They enable the analyst to drive the acquisition process through the online services considered potential sources of evidence. During the process, all data flowing through the network is automatically collected (i.e., all the IP packets). The second one also collects the graphical representation of the acquisition (e.g., how the browser visualizes such data). Both methods introduce a trusted third party (acting as a digital notary) which is in charge of collecting and "certifying" network evidence. Before closing the acquisition process, a detailed report of the collected evidence is generated and made available to the analyst along with the collected data. Cryptographic primitives are used to demonstrate ex post data integrity, how it has been acquired and the acquisition time.As a proof of concept two prototypes have been implemented. To enhance the Court confidence of the collected evidence, at the same time, the service could be run across multiple coordinated servers acquiring the same data from different point of the network.

show abstract

“…The analysis of these new properties, together with the old ones, allow us to extrapolate the behavior of a cyber weapon. Therefore, the results of the cyber-profile are composed by a series of information that can be used as "filters" for the monitoring and the analysis of data streams [5], [15], in order to have a more efficient identification of the actors of a cyber conflict. In fact, this type of profile allows a real-time awareness of possible situations of attack and facilitate the implementation of an effective dynamic system of cyber defense.…”

Section: Profiling the Cyberspacementioning

confidence: 99%

Cyber Threats Monitoring: Experimental Analysis of Malware Behavior in Cyberspace

Colombini

Colella²,

Mattiucci³

et al. 2013

Security Engineering and Intelligence Informatics

Self Cite

View full text Add to dashboard Cite

Abstract. Cyberspace is a borderless new universe in which all actors, including States, share information and communications technologies, now indispensable to the modern lifestyle. Starting from the beginning of the 21st century, the ability to leverage the cyberspace has become the most important source of power. Due to the proliferation of ICT systems into all aspects of life, the importance of information for political matters has increased awfully. State and non-State actors can use this power to achieve objectives into cyberspace and physical world. Low cost and high potential impact make cyber-power attractive to all actors. In fact, cyber threats have grown exponentially with the proliferation of the cyberspace infrastructures. Consequently, cyberspace has become a war-fighting domain with the potential to destroy or make useless logical, physical, technical, and virtual infrastructure, damaging in fact critical National capabilities.This scenario forces all national institutions to a review of their defense strategies, because of the difficulties to identify the actors of a cyber-attack. It then becomes necessary to gain a broader view of the problem to acquire more detailed information, useful to identify such sources of cyber-attacks. This new point of view can be achieved by using the analytical method developed by the authors and applied to data streams flowing across the cyberspace. In this way we can collect, detect, isolate and analyze the behavior of those malware that are acting as cyber weapons, through the implementation of an honeypot-based system such as the one presented in this paper.

show abstract

Network Profiling: Content Analysis of Users Behavior in Digital Communication Channel

Cited by 8 publications

References 7 publications

Amplification DDoS Attacks: Emerging Threats and Defense Strategies

Amplification DDoS Attacks: Emerging Threats and Defense Strategies

Forensically-Sound Methods to Collect Live Network Evidence

Cyber Threats Monitoring: Experimental Analysis of Malware Behavior in Cyberspace

Contact Info

Product

Resources

About