Packet Storage at Multi-gigabit Rates Using Off-the-Shelf Systems

Moreno, Víctor; Río, Pedro M. Santiago del; Ramos, Javier; García‐Dorado, José Luis; González, Iván; Arribas, Francisco Javier Gómez; Aracil, Javier

doi:10.1109/hpcc.2014.81

Cited by 12 publications

(11 citation statements)

References 10 publications

(8 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Best theoretical compression ratio 3.0 3.5 4.0 3.9 4.9 6.1 6.3 6.2 6.0 6. 5 We determined the overall data reduction ratio (𝐷𝑅 ) of each configuration as shown in Table III. Then, we repeated the false positive rate evaluation of previous works with the data reduction ratios shown in this table.…”

Section: Evaluation Of Cbidmentioning

confidence: 99%

See 1 more Smart Citation

An Effective Payload Attribution Scheme for Cybercriminal Detection Using Compressed Bitmap Index Tables and Traffic Downsampling

Hosseini

Jahangir

2018

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

1  Abstract-Payload Attribution Systems (PAS) are one of the most important tools of network forensics for detecting an offender after the occurrence of a cybercrime. A PAS stores the network traffic history in order to detect the source and destination pair of a certain data stream in case a malicious activity occurs on the network. The huge volume of information that is daily transferred in the network means that the data stored by a PAS must be as compact and concise as possible. Moreover, the investigation of this large volume of data for a malicious data stream must be handled within a reasonable time. For this purpose, several techniques based on storing a digest of traffic using Bloom filters have been proposed in the literature. The false positive rate of existing techniques for detecting cybercriminals is unacceptably high, i.e., many source and destination pairs are falsely determined as malicious, making it difficult to detect the true criminal. In order to ameliorate this problem, we have proposed a solution based on compressed bitmap index tables and traffic downsampling. Our analytical evaluation and experimental results show that the proposed method significantly reduces the false positive rate.

show abstract

Section: Evaluation Of Cbidmentioning

confidence: 99%

“…Many traffic recording tools have been proposed so far. See for instance [4], [5]. They can capture and archive full network traffic for high-bandwidth links.…”

Section: Introductionmentioning

confidence: 99%

An Effective Payload Attribution Scheme for Cybercriminal Detection Using Compressed Bitmap Index Tables and Traffic Downsampling

Hosseini

Jahangir

2018

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…Other proposals include OpenOnLoad [15] that rebuilds the network stack for SolarFlare products to seamlessly accelerate existing applications and HPCAP [16], a packet capture engine that focuses on the efficient storage of live traffic into non-volatile devices and to perform timestamping and delivery to multiple listeners at user-space. NetSlices [17] provides operating system abstractions towards hardware resources, such as multi-core processors and multi-queue network adapters.…”

Section: Introductionmentioning

confidence: 99%

Enif-Lang: A Specialized Language for Programming Network Functions on Commodity Hardware

Bonelli

Giordano

Procissi

2018

JSAN

View full text Add to dashboard Cite

The maturity level reached by today’s commodity platforms makes even low-cost PCs viable alternatives to dedicated hardware to implement real network functions without sacrificing performance. Indeed, the availability of multi-core processing packages and multi-queue network interfaces that can be managed by accelerated I/O frameworks, provides off-the-shelf servers with the necessary power capability for running a broad variety of network applications with near hardware-class performance. At the same time, the introduction of the Software Defined Networks (SDN) and the Network Functions Virtualization (NFV) paradigms call for new programming abstractions and tools to allow this new class of network devices to be flexibly configured and functionally repurposed from the network control plane. The paper presents the ongoing work towards Enif-Lang (Enhanced Network processIng Functional Language), a functional language for programming network functions over generic middleboxes running the Linux operating system. The language addresses concurrent programming by design and is targeted at developing simple stand-alone applications as well as pre-processing stages of packet elaborations. Enif-Lang is implemented as a Domain Specific Language embedded in the Haskell language and inherits the main principles of its ancestor, including the strong typedness and the concept of function compositions. Complex network functions are implemented by composing a set of elementary operations (primitives) by means of a compact yet expressive language grammar. Throughout the paper, the description of the design principles and features of Enif-Lang are accompanied by examples and use cases. In addition, a preliminary performance assessment is carried out to prove the effectiveness of the language for developing practical applications with the performance level required by 5G systems and the Tactile Internet.

show abstract

“…Traffic mirroring is implemented at line-rate thanks to modern switching electronics, without any impact on data plane forwarding. Some examples of analysis tools (hardware and software) are [17] [18] [19] [20]. They are capable of storing traffic coming from 10Gb/s links.…”

Section: Introductionmentioning

confidence: 99%

Ransomware Encrypted Your Files but You Restored Them from Network Traffic

Berrueta

Morató

Magaña

et al. 2018

2018 2nd Cyber Security in Networking Conference (CSNet)

View full text Add to dashboard Cite

In a scenario where user files are stored in a network shared volume, a single computer infected by ransomware could encrypt the whole set of shared files, with a large impact on user productivity. On the other hand, medium and large companies maintain hardware or software probes that monitor the traffic in critical network links, in order to evaluate service performance, detect security breaches, account for network or service usage, etc. In this paper we suggest using the monitoring capabilities in one of these tools in order to keep a trace of the traffic between the users and the file server. Once the ransomware is detected, the lost files can be recovered from the traffic trace. This includes any user modifications posterior to the last snapshot of periodic backups. The paper explains the problems faced by the monitoring tool, which is neither the client nor the server of the file sharing operations. It also describes the data structures in order to process the actions of users that could be simultaneously working on the same file. A proof of concept software implementation was capable of successfully recovering the files encrypted by 18 different ransomware families.

show abstract

Packet Storage at Multi-gigabit Rates Using Off-the-Shelf Systems

Cited by 12 publications

References 10 publications

An Effective Payload Attribution Scheme for Cybercriminal Detection Using Compressed Bitmap Index Tables and Traffic Downsampling

An Effective Payload Attribution Scheme for Cybercriminal Detection Using Compressed Bitmap Index Tables and Traffic Downsampling

Enif-Lang: A Specialized Language for Programming Network Functions on Commodity Hardware

Ransomware Encrypted Your Files but You Restored Them from Network Traffic

Contact Info

Product

Resources

About