Reverse Hashing for High-Speed Network Monitoring: Algorithms, Evaluation, and Applications

Schweller, Robert T.; Li, Z.; Chen, Y.; Gao, Yali; Gupta, Ashish; Zhang, Y.; Dinda, Peter A.; Kao, Ming-Yang; Memik, Gokhan

doi:10.1109/infocom.2006.203

Cited by 36 publications

(35 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The following parameters are chosen based on systematic study as in [20,42]. We adopt 6 stages for each RS and OS, and 5 stages for each 2D sketch in our system.…”

Section: Evaluation Methodologymentioning

confidence: 99%

“…To meet the requirements above, we propose a new paradigm called DoS resilient High-speed Flow-level INtrusion Detection, HiFIND [18] leveraging recent work on data streaming computation and in particular, sketches [19,20]. Sketches are a kind of compact data streaming data structure which record traffic for given keys and are capable of reporting heavy traffic keys.…”

Section: Fifth Separating Anomalies From Intrusions For False Positimentioning

confidence: 99%

“…Although proposed in [19,20], sketches have not been applied to building IDSes for the following reasons:…”

Section: Fifth Separating Anomalies From Intrusions For False Positimentioning

confidence: 99%

“…To address these problems, in our previous work we propose a novel framework for efficiently reversing sketches [19,20], which allows us to have separate stages for update, combine and inference. The basic idea is to hash intelligently by modifying the input keys and/or hashing functions so that we can recover the keys with large estimated values, without sacrificing detection accuracy.…”

Section: Reversible K-ary Sketchmentioning

confidence: 99%

“…There are 15 memory accesses per-packet for 48 bit reversible sketches and 16 per-packet for 64-bit reversible sketches (see [20] for details). For each two-dimensional sketch, we only need 5 memory accesses per-packet, one for each 2D hash matrix.…”

Section: Small Memory Access Per-packet For Online Monitoringmentioning

confidence: 99%

See 4 more Smart Citations

HiFIND: A high-speed flow-level intrusion detection approach with DoS resiliency

Gao

Chen

2010

Computer Networks

View full text Add to dashboard Cite

a b s t r a c tGlobal-scale attacks like worms and botnets are increasing in frequency, severity and sophistication, making it critical to detect outbursts at routers/gateways instead of end hosts. In this paper, leveraging data streaming techniques such as the reversible sketch, we design HiFIND, a High-speed Flow-level Intrusion Detection system. In contrast to existing intrusion detection systems, HiFIND: (i) is scalable to flow-level detection on high-speed networks; (ii) is DoS resilient; (iii) can distinguish SYN flooding and various port scans (mostly for worm propagation) for effective mitigation; (iv) enables aggregate detection over multiple routers/gateways; and (v) separates anomalies to limit false positives in detection. Both theoretical analysis and evaluation with several router traces show that HiFIND achieves these properties. To the best of our knowledge, HiFIND is the first online DoS resilient flow-level intrusion detection system for high-speed networks (e.g. OC192), even for the worst-case traffic of 40-byte-packet streams with each packet forming a flow.

show abstract

“…The following parameters are chosen based on systematic study as in [20,42]. We adopt 6 stages for each RS and OS, and 5 stages for each 2D sketch in our system.…”

Section: Evaluation Methodologymentioning

confidence: 99%

Section: Fifth Separating Anomalies From Intrusions For False Positimentioning

confidence: 99%

“…Although proposed in [19,20], sketches have not been applied to building IDSes for the following reasons:…”

Section: Fifth Separating Anomalies From Intrusions For False Positimentioning

confidence: 99%

Section: Reversible K-ary Sketchmentioning

confidence: 99%

Section: Small Memory Access Per-packet For Online Monitoringmentioning

confidence: 99%

See 3 more Smart Citations

HiFIND: A high-speed flow-level intrusion detection approach with DoS resiliency

Gao

Chen

2010

Computer Networks

View full text Add to dashboard Cite

show abstract

A scalable, efficient and informative approach for anomaly‐based intrusion detection systems: theory and practice

2010

View full text Add to dashboard Cite

SUMMARYIn this paper, we present the design and implementation of a new approach for anomaly detection and classification over high speed networks. The proposed approach is based first of all on a data reduction phase through flow sampling by focusing mainly on short lived flows. The second step is then a random aggregation of some descriptors such as a number of SYN packets per flow in two different data structures called Count Min Sketch and Multi-Layer Reversible Sketch. A sequential change point detection algorithm continuously monitors the sketch cell values. An alarm is raised if a significant change is identified in cell values. With an appropriate definition of the combination of IP header fields that should be used to identify one flow, we are able not only to detect the anomaly but also to classify the anomaly as DoS, DDoS or flash crowd, network scanning and port scanning. We validate our framework for anomaly detection on various real world traffic traces and demonstrate the accuracy of our approach on these real-life case studies. Our analysis results from online implementation of our algorithm over measurements gathered by a DAG sniffing card are very attractive in terms of accuracy and response time. The proposed approach is very effective in detecting and classifying anomalies, and in providing information by extracting the culprit flows with a high level of accuracy. Copyright

show abstract

A Novel Approach for Anomaly Detection over High-Speed Networks

Salem¹,

Vaton²,

Gravey³

2008

Proceedings of the 3rd European Conference on Computer Network Defense

View full text Add to dashboard Cite

Reverse Hashing for High-Speed Network Monitoring: Algorithms, Evaluation, and Applications

Cited by 36 publications

References 15 publications

HiFIND: A high-speed flow-level intrusion detection approach with DoS resiliency

HiFIND: A high-speed flow-level intrusion detection approach with DoS resiliency

A scalable, efficient and informative approach for anomaly‐based intrusion detection systems: theory and practice

A Novel Approach for Anomaly Detection over High-Speed Networks

Contact Info

Product

Resources

About