direkt zum Inhalt springen

direkt zum Hauptnavigationsmenü

Sie sind hier

TU Berlin

Inhalt des Dokuments

Es gibt keine deutsche Übersetzung dieser Webseite.

Holger Dreger's Publications

Enriching Network Security Analysis with Time Travel
Zitatschlüssel MSDFPS-ENSATT-08
Autor Maier, Gregor and Sommer, Robin and Dreger, Holger and Feldmann, Anja and Paxson, Vern and Schneider, Fabian
Buchtitel SIGCOMM '08: Proceedings of the 2008 conference on Applications, technologies, architectures, and protocols for computer communications
Seiten 183–194
Jahr 2008
ISBN 978-1-60558-175-0
ISSN 0146-4833
DOI http://dx.doi.org/10.1145/1402946.1402980
Ort Seattle, WA, USA
Adresse New York, NY, USA
Monat August
Notiz Please find the slides of the talk held during SIGCOMM'08 at http://www.net.t-labs.tu-berlin.de/papers/MSDFPS-ENSATT-08-slides.pdf.
Verlag ACM Press
Zusammenfassung In many situations it can be enormously helpful to archive the raw contents of a network traffic stream to disk, to enable later inspection of activity that becomes interesting only in retrospect. We present a Time Machine (TM) for network traffic that provides such a capability. The TM leverages the heavy-tailed nature of network flows to capture nearly all of the likely-interesting traffic while storing only a small fraction of the total volume. An initial proof-of-principle prototype established the forensic value of such an approach, contributing to the investigation of numerous attacks at a site with thousands of users. Based on these experiences, a rearchitected implementation of the system provides flexible, high-performance traffic stream capture, indexing and retrieval, including an interface between the TM and a real-time network intrusion detection system (NIDS). The NIDS controls the TM by dynamically adjusting recording parameters, instructing it to permanently store suspicious activity for offline forensics, and fetching traffic from the past for retrospective analysis. We present a detailed performance evaluation of both stand-alone and joint setups, and report on experiences with running the system live in high-volume environments.
Link zur Publikation [1] Download Bibtex Eintrag [2]
------ Links: ------

Zusatzinformationen / Extras


Schnellnavigation zur Seite über Nummerneingabe

Copyright TU Berlin 2008