Open Packet Monitoring on FLAME: Safety, Performance, and Applications

Anagnostakis, Kostas G.; Greenwald, Michael B.; Ioannidis, Sotiris; Miltchev, Stefan

doi:10.1007/3-540-36199-5_10

Cited by 16 publications

(17 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…That is, a node cannot be actively "on the lookout" for an arbitrary number of viruses without adversely affecting its performance. (Some experimental measurements of such real-world limits are given in [4]). Edge-routers are more likely to be constrained by high packet rates, and therefore limited in the amount of scanning they can perform.…”

Section: State Of Nodesmentioning

confidence: 98%

COVERAGE: detecting and reacting to worm epidemics using cooperation and validation

Anagnostakis

Greenwald²,

Ioannidis

et al. 2007

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

Cooperative defensive systems communicate and cooperate in their response to worm attacks, but determine the presence of a worm attack solely on local information. Distributed worm detection and immunization systems track suspicious behavior at multiple cooperating nodes to determine whether a worm attack is in progress. Earlier work has shown that cooperative systems can respond quickly to day-zero worms, while distributed detection systems allow detectors to be more conservative (i.e., paranoid) about potential attacks because they manage false alarms efficiently. In this paper we present our investigation into the complex tradeoffs in such systems between communication costs, computation overhead, accuracy of the local tests, estimation of viral virulence, and the fraction of the network infected before the attack crests. We evaluate the effectiveness of different system configurations in various simulations. Our experiments show that distributed algorithms are better able to balance effectiveness against worms and viruses with reduced cost in computation and communication when faced with false alarms. Furthermore, cooperative, distributed systems seem more robust against malicious participants in the immunization system than earlier cooperative but nondistributed approaches.

show abstract

Section: State Of Nodesmentioning

confidence: 98%

COVERAGE: detecting and reacting to worm epidemics using cooperation and validation

Anagnostakis

Greenwald²,

Ioannidis

et al. 2007

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

show abstract

“…The formula of HASH value is calculated as: HASHKEY = SrcIP + SrcPort + DstIP + DstPort (1) HASHKEY = DstIP + DstPort + SrcIP + SrcPort (2) Since a session is a two-way communication between a pair of hosts, Therefore formula (1) and formula (2) can be mapped to the same table entry of HASH table. According to the HASH value, it can be recovery the data which belong to one session.…”

Section: Bmentioning

confidence: 99%

“…Finally, be delivered to the application protocol analysis module, According to the different application layer protocol. Analyze and resolve High-level application protocol data [2] [3][4].…”

Section: Bmentioning

confidence: 99%

The Design and Implementation of WebMail Content and Attachments Recovery System

Zhou

2010

2010 International Conference on E-Product E-Service and E-Entertainment

View full text Add to dashboard Cite

The system of WebMail content and attachments recovery can monitor the network without affecting the performance of the network, check the network for confidential information leakage phenomenon. if found it will store the leak records into the hard disk automatically which will be used as evidence for security sectors. This paper introduces in detail the design and implementation of the WebMail content and attachments recovery system.

show abstract

“…In the SANE architecture, KeyNote was used to limit the privileges of network users and their mobile code, by specifying the operations such code was allowed to perform on any particular active node. KeyNote was used in a similar manner in the FLAME architecture [25][26][27], and to provide an economy for resources in an active network [28].…”

Section: Micropayments: Microchecks and Filetellermentioning

confidence: 99%

Experience with the KeyNote Trust Management System: Applications and Future Directions

Blaze

Ioannidis

Keromytis

2003

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Access control in distributed systems has been an area of intense research in recent years. One promising approach has been that of trust management, whereby authentication and authorization decisions are combined in a unified framework for evaluating security policies and credentials. In this paper, we report on our experience of the past seven years using the PolicyMaker and the KeyNote trust management systems in a variety of projects. We start with a brief overview of trust management in general, and KeyNote in particular; we describe several applications of trust management; we then discuss various features we found missing from our initial version of KeyNote, which would have been useful in the various applications it was used. We conclude the paper with our plans for future research.

show abstract

Open Packet Monitoring on FLAME: Safety, Performance, and Applications

Cited by 16 publications

References 26 publications

COVERAGE: detecting and reacting to worm epidemics using cooperation and validation

COVERAGE: detecting and reacting to worm epidemics using cooperation and validation

The Design and Implementation of WebMail Content and Attachments Recovery System

Experience with the KeyNote Trust Management System: Applications and Future Directions

Contact Info

Product

Resources

About