Anomaly Detection and Mitigation at Internet Scale: A Survey

Over recent years, network-based attacks have become one of the top causes of network infrastructure and service outages. To counteract such attacks, an approach is to move mitigation from the target network to the networks of Internet Service Providers (ISP). However, it remains unclear to what extent countermeasures are set up and which mitigation approaches are adopted by ISPs. The goal of this paper is to present the results of a survey that aims to gain insight into processes, structures and capabilities of ISPs to mitigate and respond to network-based attacks.

show abstract

“…We distributed our survey using several relevant mailing lists as described in [8]. The most important ones are listed in Table II.…”

Section: Survey Methodologymentioning

confidence: 99%

Collaborative attack mitigation and response: A survey

Steinberger

Sperotto

Baier

et al. 2015

2015 IFIP/IEEE International Symposium on Integrated Network Management (IM)

Self Cite

View full text Add to dashboard Cite

show abstract

“…Several host-based and network-based approaches to incident (and intrusion) detection have been proposed in literature [34,30,9,10,4]. Some of these approaches are anomaly-based, and rely on models based on traffic or events generated during a normal operation of the system [13,32,12,6].…”

Section: Related Workmentioning

confidence: 99%

Situational awareness through reasoning on network incidents

Squicciarini

Petracca

Horne

et al. 2014

Proceedings of the 4th ACM Conference on Data and Application Security and Privacy

View full text Add to dashboard Cite

Corporations worldwide work with teams of often dedicated system administrators to maintain, detect and prevent network infringements. This is a highly user-driven process that consumes hundreds (if not thousands) of man hours yearly. User reporting, the basis of most of these incident detection systems suffers from various biases and leads to below-par security measures. In the paper, we provide an approach for near real-time analysis of ongoing events on controlled networks, while requiring no end-user interaction and saving on system administrator's effort. Our proposed solution, ReasONets, a lightweight, distributed system, provides situational awareness in case of network incidents. ReasONets combines aspects of anomaly detection with CaseBased Reasoning (CBR) methodologies to reason about ongoing security events in a network, including their nature, severity and sources. We build a fully running prototype of ReasONets, to demonstrate the accuracy of the system, in doing reasoning and inference on the network status by exploiting events and network features. To the best of our knowledge, ReasONets is the first of its kind system combining detection and classification of network events with realtime reasoning while being capable of scaling up to large network sizes.

show abstract

“…This approach benefits from its overview of the network that allows to discover behavioural similarities of different connected systems. The benefit of tackling distributed large-scale attacks at provider level has been discussed in [13] and demonstrated by [4]. Further, initiatives to incentivize ISPs to mitigate botnets are already ongoing [8].…”

Section: Introductionmentioning

confidence: 99%

How to Achieve Early Botnet Detection at the Provider Level?

Dietz¹,

Sperotto²,

Dreo³

et al. 2016

Management and Security in the Age of Hyperconnectivity

View full text Add to dashboard Cite

Botnets are an enabler for many cyber-criminal activities and often responsible for DDoS attacks, banking fraud, cyber-espionage and extortion. Botnets are controlled by a botmaster that uses various advanced techniques to create, maintain and hide their complex and distributed C&C infrastructures. First, they use P2P techniques and domain fast-flux to increase the resilience against take-down actions. Second, botnets encrypt their communication payload to prevent signature based detection. Both, the actions to increase the resilience and the prevention of signature based detection are counteractions against detection techniques. In contrast to existing approaches, our novel approach includes DNS registration behaviour, which we currently analyse for the .com, .net and .org domains, representing half of registered domains on the Internet. Hence, the goal of this PhD research is to enable early detection of the deployment and operation of botnets to facilitate proactive mitigation strategies, whereas current approaches usually detect botnets while these are already in active use. Consequently, this proactive approach prevents botnets to fully evolve their size and attack power. Moreover, as many end users are unable to detect and clean infected machines, our approach tackles the botnet phenomenon without requiring any end user involvement, by incorporating ISPs and domain name registrars. In addition, this will enable the discovery of similar behaviour of different connected systems, which allows detection in cases where bots are registered under domains that are not willing to cooperate.

show abstract

Anomaly Detection and Mitigation at Internet Scale: A Survey

Cited by 17 publications

References 7 publications

Collaborative attack mitigation and response: A survey

Collaborative attack mitigation and response: A survey

Situational awareness through reasoning on network incidents

How to Achieve Early Botnet Detection at the Provider Level?

Contact Info

Product

Resources

About