Empirical Analysis of Rate Limiting + Leap Ahead (RL+LA) Countermeasure against Witty Worm

Shahzad, Khurram; Woodhead, Steve

doi:10.1109/cit/iucc/dasc/picom.2015.305

Cited by 3 publications

(1 citation statement)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although flow monitoring loses a large amount of detailed information that is contained in the payload and headers of packets, it does capture the general traffic characteristics. These characteristics have proven to be highly useful for combating attacks such as worm propagation [21][22][23][40][41][42].…”

Section: Flow Monitoringmentioning

confidence: 99%

Network Measurements and Security: Untangling the Web of Domain Names, Certificates, and Mobile Apps

Hageman¹

View full text Add to dashboard Cite

General rightsCopyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.-Users may download and print one copy of any publication from the public portal for the purpose of private study or research. -You may not further distribute the material or use it for any profit-making activity or commercial gain -You may freely distribute the URL identifying the publication in the public portal -

show abstract

Section: Flow Monitoringmentioning

confidence: 99%

Network Measurements and Security: Untangling the Web of Domain Names, Certificates, and Mobile Apps

Hageman¹

View full text Add to dashboard Cite

show abstract

Epidemiological modeling of network worm infections and countermeasures

Shahzad

Woodhead

2015

2015 IEEE Seventh International Conference on Intelligent Computing and Information Systems (ICICIS)

View full text Add to dashboard Cite

Understanding the Challenges of Blocking Unnamed Network Traffic

Hageman

Kidmose

Hansen

et al. 2022

NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

Network traffic that is not preceded by any Domain Name System (DNS) resolutions is referred to as unnamed traffic. Any DNS-based security system is ineffective against malicious content distributed through this traffic. In this paper, we introduce a novel method for identifying unnamed traffic based on the correlation of flows and DNS responses extracted from raw network traces. We describe two challenges that affect the validity of our method, and how to handle them. By applying our method to a one-week trace of network traffic, we illustrate that unnamed traffic is ubiquitous in a university network across nearly all client systems, destination IP addresses, and destination services. We conclude by presenting several open problems that prevent us from blocking unnamed traffic for security reasons.

show abstract

Empirical Analysis of Rate Limiting + Leap Ahead (RL+LA) Countermeasure against Witty Worm

Cited by 3 publications

References 22 publications

Network Measurements and Security: Untangling the Web of Domain Names, Certificates, and Mobile Apps

Network Measurements and Security: Untangling the Web of Domain Names, Certificates, and Mobile Apps

Epidemiological modeling of network worm infections and countermeasures

Understanding the Challenges of Blocking Unnamed Network Traffic

Contact Info

Product

Resources

About