Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity最新文献

筛选
英文 中文
It's Time for An Internet-wide Recommitment to Measurement: And Here's How We Should Do It 是时候在互联网范围内重新承诺测量了:我们应该这样做
P. Vixie
{"title":"It's Time for An Internet-wide Recommitment to Measurement: And Here's How We Should Do It","authors":"P. Vixie","doi":"10.1145/2903185.2903186","DOIUrl":"https://doi.org/10.1145/2903185.2903186","url":null,"abstract":"There has never been a greater need for comprehensive Internet metrics than now. Even basic security-critical facts about the Internet, such as \"How many systems are botted?\" or \"What networks still don't do Source Address Validation?\" remain murky and poorly quantified. Likewise, traffic characterization and summary inter-AS flow data typically remain closely-held proprietary information, rather than routinely-shared basic operational data. Without trustworthy Internet measurements of this sort, we're \"driving blind\" and will routinely make suboptimal choices about critical technical policies, including issues as fundamental as network neutrality. System and network measurements were once an integral part of Internet practice, something that was hardly surprising given the Internet's roots in the university community. Scientists naturally make observations, record data, and analyze that data to document phenomena and advance the state-of-the-art. More recently, however, a variety of factors have created an online environment that's hostile to legitimate academic Internet measurement and monitoring efforts. Major drivers contribute to that public hostility, including overly-aggressive marketing analytics and domestic pervasive monitoring by the intelligence community. It all feels like eavesdropping to the public, even though important real differences exist and reforms have taken place. Bottom line, the public is having none of any of it.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127278562","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Session details: Algorithms 会话详细信息:算法
Maciej Korczyński
{"title":"Session details: Algorithms","authors":"Maciej Korczyński","doi":"10.1145/3254076","DOIUrl":"https://doi.org/10.1145/3254076","url":null,"abstract":"","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115046191","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
FNFD: A Fast Scheme to Detect and Verify Non-Technical Loss Fraud in Smart Grid 一种快速检测和验证智能电网非技术损失欺诈的方案
Wenlin Han, Yang Xiao
{"title":"FNFD: A Fast Scheme to Detect and Verify Non-Technical Loss Fraud in Smart Grid","authors":"Wenlin Han, Yang Xiao","doi":"10.1145/2903185.2903188","DOIUrl":"https://doi.org/10.1145/2903185.2903188","url":null,"abstract":"Non-Technical Loss (NTL) fraud is a very common fraud in power systems. In traditional power grid, energy theft, via meter tampering, is the main form of NTL fraud. With the rise of Smart Grid, adversaries can take advantage of two-way communication to commit NTL frauds by meter manipulation or network intrusion. Previous schemes were proposed to detect NTL frauds but are not efficient. In this paper, we propose a Fast NTL Fraud Detection and verification scheme (FNFD). FNFD is based on Recursive Least Square (RLS) to model adversary behavior. Experimental results show that FNFD outperforms existing schemes in terms of efficiency and overhead.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"72 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126529629","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 23
Characterizing Roles and Spatio-Temporal Relations of C&C Servers in Large-Scale Networks 大规模网络中C&C服务器的角色与时空关系表征
Romain Fontugne, J. Mazel, K. Fukuda
{"title":"Characterizing Roles and Spatio-Temporal Relations of C&C Servers in Large-Scale Networks","authors":"Romain Fontugne, J. Mazel, K. Fukuda","doi":"10.1145/2903185.2903192","DOIUrl":"https://doi.org/10.1145/2903185.2903192","url":null,"abstract":"Botnets are accountable for numerous cybersecurity threats. A lot of efforts have been dedicated to botnet intelligence, but botnets versatility and rapid adaptation make them particularly difficult to outwit. Prompt countermeasures require effective tools to monitor the evolution of botnets. Therefore, in this paper we analyze 5 months of traffic from different botnet families, and propose an unsupervised clustering technique to identify the different roles assigned to C&C servers. This technique allows us to classify servers with similar behavior and effectively identify bots contacting several servers. We also present a temporal analysis method that uncovers synchronously activated servers. Our results characterize 6 C&C server roles that are common to various botnet families. In the monitored traffic we found that servers are usually involved in a specific role, and we observed a significant number of C&C servers scanning the Internet.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"98 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127501598","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Session details: Measurements of Security, Attacks, and Fraud 会话细节:安全度量、攻击和欺诈
M. van Eeten
{"title":"Session details: Measurements of Security, Attacks, and Fraud","authors":"M. van Eeten","doi":"10.1145/3254075","DOIUrl":"https://doi.org/10.1145/3254075","url":null,"abstract":"","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"100 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127109825","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A High Performance IPv6 Flow Table Lookup Algorithm Based on Hash 一种基于Hash的高性能IPv6流表查找算法
Huan Guo, Zhengmin Li, Qingyun Liu, Jia Li, Zhou-yu Zhou, Bo Sun
{"title":"A High Performance IPv6 Flow Table Lookup Algorithm Based on Hash","authors":"Huan Guo, Zhengmin Li, Qingyun Liu, Jia Li, Zhou-yu Zhou, Bo Sun","doi":"10.1145/2903185.2903187","DOIUrl":"https://doi.org/10.1145/2903185.2903187","url":null,"abstract":"With the rapid increasing IPv6 network traffic, some network process systems like DPI and firewall cannot meet the demand of high network bandwidth. Flow table based on hash is one of the bottlenecks. In this paper, we measure the characteristics of IPv6 address and propose an entropy based revision hash algorithm, which can produce a better distribution within acceptable time. Moreover, we use a hierarchical hash strategy to reduce hash table lookup times further more even in extreme cases.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128068460","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
An Efficient Method for Detecting Obfuscated Suspicious JavaScript Based on Text Pattern Analysis 一种基于文本模式分析的可疑JavaScript混淆检测方法
Jiawei Su, K. Yoshioka, Junji Shikata, Tsutomu Matsumoto
{"title":"An Efficient Method for Detecting Obfuscated Suspicious JavaScript Based on Text Pattern Analysis","authors":"Jiawei Su, K. Yoshioka, Junji Shikata, Tsutomu Matsumoto","doi":"10.1145/2903185.2903189","DOIUrl":"https://doi.org/10.1145/2903185.2903189","url":null,"abstract":"The malicious JavaScript is a common springboard for attackers to launch several types of network attacks, such as Drive-by-Download and malicious PDF delivery attack. In order to elude detection of signature matching, malicious JavaScript is often packed (so-called \"obfuscation\") with diversified algorithms therefore the occurrence of obfuscation is always a good pointer for potential maliciousness. In this investigation, we propose a light weight approach for quickly filtering obfuscated JavaScript by a novel method of tokenizing JavaScript text at letter level and information-theoretic measures, based on the previous work in the domain of detecting obfuscated malicious code as well as the pattern analysis of natural languages. The new approach is apparently time efficient compared to existing systems since it processes much less objects while it is also proved to be able to reach the acceptable detection accuracies.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130646595","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Fast and Accurate Identification of Active Recursive Domain Name Servers in high-speed Network 高速网络中主动递归域名服务器的快速准确识别
Xiaomei Liu, Yong Sun, Caiyun Huang, Xueqiang Zou, Zhiguang Qin
{"title":"Fast and Accurate Identification of Active Recursive Domain Name Servers in high-speed Network","authors":"Xiaomei Liu, Yong Sun, Caiyun Huang, Xueqiang Zou, Zhiguang Qin","doi":"10.1145/2903185.2903190","DOIUrl":"https://doi.org/10.1145/2903185.2903190","url":null,"abstract":"Fast and accurate identification of active recursive domain name servers (RDNS) is a fundamental step to evaluate security risk degrees of DNS systems. Much identification work have been proposed based on network traffic measurement technology. Even though identifying RDNS accurately, they waste huge network resources, and fail to obtain host activity and distinguish between direct and indirect RDNS. In this paper, we proposed an approach to identify direct and forward RDNS based on our three key insights on their request-response behaviors, and proposed an approach to identify indirect RDNS based on CNAME redirect behaviors. To work in high-speed backbone networks, we further proposed an online connectivity estimation algorithm to obtain estimated values used in our identification approaches. According to our experiments, we can identify RDNS with a high accuracy by selecting the reasonable thresholds. The accuracy of identifying direct and forward RDNS can reach 89%.The accuracy of identifying indirect RDNS can reach 90%.Moreover, our work is capable of real-time analyzing high speed backbone traffics.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"41 6","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114029947","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Image Processing Pipeline Model Integrating Steganographic Algorithms for Mobile Cameras 集成隐写算法的移动相机图像处理流水线模型
P. Dahal, D. Peng, H. Sharif
{"title":"Image Processing Pipeline Model Integrating Steganographic Algorithms for Mobile Cameras","authors":"P. Dahal, D. Peng, H. Sharif","doi":"10.1145/2903185.2903191","DOIUrl":"https://doi.org/10.1145/2903185.2903191","url":null,"abstract":"Mobile phones these days are extensively used to capture and share multimedia right from the device without the basic security processing like watermarking. This necessitates the need for multimedia to be watermarked right within the mobile hardware for copyright protection and authentication. In this paper, we propose an image processing pipelining model for mobile cameras that integrates watermarking algorithm with the image capturing processes in cameras. Differently from existing works reported in literature, the unique contribution in this paper is to have image watermarked while in the early capturing process. In other words, the processes for digital image capturing and watermarking have become as a single non-separable procedure in the camera hardware systems. The paper proposes watermarking raw image data before it becomes display ready within the image capturing process. Also, the watermarking algorithm used to develop the model, without losing generality, caters to the computational efficiency requirement for mobile devices while being robust against image coding at the same time. Simulations results demonstrate that the proposed approach is robust against JPEG compression.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"55 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114667087","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity 2016年ACM国际网络安全流量测量研讨会论文集
{"title":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","authors":"","doi":"10.1145/2903185","DOIUrl":"https://doi.org/10.1145/2903185","url":null,"abstract":"","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132658193","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术官方微信
小红书