TU Berlin

Internet Network ArchitecturesFabian Schneider's Publications

Page Content

to Navigation

Fabian Schneider's Publications

Enriching Network Security Analysis with Time Travel
Citation key MSDFPS-ENSATT-08
Author Maier, Gregor and Sommer, Robin and Dreger, Holger and Feldmann, Anja and Paxson, Vern and Schneider, Fabian
Title of Book SIGCOMM '08: Proceedings of the 2008 conference on Applications, technologies, architectures, and protocols for computer communications
Pages 183–194
Year 2008
ISBN 978-1-60558-175-0
ISSN 0146-4833
DOI http://dx.doi.org/10.1145/1402946.1402980
Location Seattle, WA, USA
Address New York, NY, USA
Month August
Note Please find the slides of the talk held during SIGCOMM'08 at http://www.net.t-labs.tu-berlin.de/papers/MSDFPS-ENSATT-08-slides.pdf.
Publisher ACM Press
Abstract In many situations it can be enormously helpful to archive the raw contents of a network traffic stream to disk, to enable later inspection of activity that becomes interesting only in retrospect. We present a Time Machine (TM) for network traffic that provides such a capability. The TM leverages the heavy-tailed nature of network flows to capture nearly all of the likely-interesting traffic while storing only a small fraction of the total volume. An initial proof-of-principle prototype established the forensic value of such an approach, contributing to the investigation of numerous attacks at a site with thousands of users. Based on these experiences, a rearchitected implementation of the system provides flexible, high-performance traffic stream capture, indexing and retrieval, including an interface between the TM and a real-time network intrusion detection system (NIDS). The NIDS controls the TM by dynamically adjusting recording parameters, instructing it to permanently store suspicious activity for offline forensics, and fetching traffic from the past for retrospective analysis. We present a detailed performance evaluation of both stand-alone and joint setups, and report on experiences with running the system live in high-volume environments.
Link to publication Download Bibtex entry


Quick Access

Schnellnavigation zur Seite über Nummerneingabe