SDN-inspired, real-time botnet detection and flow-blocking at ISP and enterprise-level

Haq, Osama; Abaid, Zainab; Bhatti, Naveed Anwar; Ahmed, Zaafar; Syed, Affan A.

doi:10.1109/icc.2015.7249162

Cited by 9 publications

(4 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Mais adiante, nas proximidades da vítima, apesar do tráfego de ataque ser mais proeminente para detecção [Kim et al 2006, Hoque et al 2015], ele pode já ter saturado recursos in-path. A alternativa é implantar medidas defensivas em Provedores de Serviços de Internet (ISPs), que gerenciam a comunicação [Haq et al 2015, Kang et al 2016. Os ISPs se beneficiam de uma visão privilegiada do tráfego e contam com links de alta taxa de transferência, permitindo que eles descubram e impeçam as ameaças em tempo hábil.…”

Section: Explorando Planos De Dados Programáveis Para Detectar Ataque...unclassified

Segurança Cibernética 2030: Experiências, Desafios e Oportunidades

Schaeffer-Filho,

Nobre,

Wickboldt

et al. 2023

Escola De Computação PPGC/UFRGS 50 Anos: Transformando Desafios Em Oportunidades Para O Futuro

View full text Add to dashboard Cite

Cybersecurity has assumed an increasingly critical role as a fundamental pillar of a digital society, deeply interconnected and increasingly dependent on services provisioned via consolidated (e.g., 4G/5G) and emerging (such as artificial intelligence) technologies and concepts. In this context, expectations have increased that computing can contribute to solving emerging challenges in cybersecurity, especially those challenges intrinsically influenced by the particularities of Brazilian society. In this sense, there is great expectation about how computational solutions can support cybersecurity professionals and researchers in solving the challenges that plague our digital society, such as fake news, cyber scams, identity theft, data theft, privacy violations, etc. This chapter will address the cybersecurity research landscape, highlighting the opportunities and challenges that are relevant for the next decade: People-centric security, Artificial intelligence and security and Security in the era of programmable networks. ResumoA cibersegurança tem assumido um papel cada vez mais crítico como pilar fundamental de uma sociedade digital, profundamente interconectada e cada vez mais dependente de serviços provisionados via tecnologias e conceitos consolidados (por ex., 4G/5G) e emergentes (como inteligência artificial). Neste contexto, aumentaram as expectativas de que a computação possa contribuir na solução dos desafios emergentes em segurança cibernética, em especial àqueles desafios intrinsecamente influenciados pelas Vídeo com a apresentação do capítulo: https://youtu.be/uEyOldWYauI

show abstract

Section: Explorando Planos De Dados Programáveis Para Detectar Ataque...unclassified

Segurança Cibernética 2030: Experiências, Desafios e Oportunidades

Schaeffer-Filho,

Nobre,

Wickboldt

et al. 2023

Escola De Computação PPGC/UFRGS 50 Anos: Transformando Desafios Em Oportunidades Para O Futuro

View full text Add to dashboard Cite

show abstract

Section: Explorando Planos De Dados Programáveis Para Detectar Ataque...unclassified

“…O sistema de detecção de DDoS é composto por um único switch programável que executa de forma independente a análise estatística em banda para detectar ataques DDoS. Como esses ataques são caracterizados por uma grande quantidade de hosts convergindo o tráfego para uma ou poucas vítimas [Haq et al 2015], as distribuições de endereços IP de origem e destino tendem a se desviar de seu padrão normal na presença de tráfego malicioso. A entropia de Shannon [Shannon 1948] é frequentemente utilizada como forma de identificar esse desvio, apresentando alta precisão para este objetivo [Lakhina et al 2005, Bhuyan et al 2015.…”

Section: Explorando Planos De Dados Programáveis Para Detectar Ataque...unclassified

Protegendo Redes de Computadores na era do Plano de Dados Programáveis

Jacobs¹,

Azambuja²,

Schaeffer-Filho³

et al. 2022

Minicursos Do XXII Simpósio Brasileiro De Segurança Da Informação E De Sistemas Computacionais

View full text Add to dashboard Cite

Recent advances in Software Defined Networking (SDN) have expanded our ability to program the network towards the data plane. Through domain-specific languages like P4, network operators can quickly implement new protocols in forwarding devices, customize their functionality and develop innovative services. This flexibility comes, however, at a cost: security and correctness properties of the entire network (e.g., isolation and accessibility) become much more difficult to guarantee, because the behavior of the network is now determined by a combination of the configuration maintained by the control plane and data plane programs residing on forwarding devices. In this context, existing tools for network verification, which depend on a fixed and invariant model of the data plane, are inadequate for programmable data planes. This chapter aims to foster discussion on this subject, by presenting (i) how the concept of data plane programmability can be used to make computer networks more secure, and (ii) what major security challenges emerge along with the concept.

show abstract

“…In the first category of research, the idea of a bot "lifecycle", first proposed in [8], has been used to identify botnet infections, by monitoring for the various behavioural stages that a botnet infection exhibits; infections are declared if multiple such stages are observed on a host in a particular sequence [16]- [18]. An example of this approach is found in BotHunter [17], where a host is classified as infected if it engages in communication sessions belonging to multiple "lifecycle" stages, such as malware downloading, C&C communication, and performing attacks.…”

Section: Related Workmentioning

confidence: 99%

All Infections are Not Created Equal: Time-Sensitive Prediction of Malware Generated Network Attacks

Abaid,

Sarkar,

Kaafar

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Many techniques have been proposed for quickly detecting and containing malware-generated network attacks such as large-scale denial of service attacks; unfortunately, much damage is already done within the first few minutes of an attack, before it is identified and contained. There is a need for an early warning system that can predict attacks before they actually manifest, so that upcoming attacks can be prevented altogether by blocking the hosts that are likely to engage in attacks. However, blocking responses may disrupt legitimate processes on blocked hosts; in order to minimise user inconvenience, it is important to also foretell the time when the predicted attacks will occur, so that only the most urgent threats result in auto-blocking responses, while less urgent ones are first manually investigated. To this end, we identify a typical infection sequence followed by modern malware; modelling this sequence as a Markov chain and training it on real malicious traffic, we are able to identify behaviour most likely to lead to attacks and predict 98% of real-world spamming and port-scanning attacks before they occur. Moreover, using a Semi-Markov chain model, we are able to foretell the time of upcoming attacks, a novel capability that allows accurately predicting the times of 97% of real-world malware attacks. Our work represents an important and timely step towards enabling flexible threat response models that minimise disruption to legitimate users.

show abstract

SDN-inspired, real-time botnet detection and flow-blocking at ISP and enterprise-level

Cited by 9 publications

References 11 publications

Segurança Cibernética 2030: Experiências, Desafios e Oportunidades

Segurança Cibernética 2030: Experiências, Desafios e Oportunidades

Protegendo Redes de Computadores na era do Plano de Dados Programáveis

All Infections are Not Created Equal: Time-Sensitive Prediction of Malware Generated Network Attacks

Contact Info

Product

Resources

About