Enriching network security analysis with time travel Export

@inproceedings{Maier08Enriching, abstract = {In many situations it can be enormously helpful to archive the raw contents of a network traffic stream to disk, to enable later inspection of activity that becomes interesting only in retrospect. We present a Time Machine (TM) for network traffic that provides such a capability. The TM leverages the heavy-tailed nature of network flows to capture nearly all of the likely-interesting traffic while storing only a small fraction of the total volume. An initial proof-of-principle prototype established the forensic value of such an approach, contributing to the investigation of numerous attacks at a site with thousands of users. Based on these experiences, a rearchitected implementation of the system provides flexible, highperformance traffic stream capture, indexing and retrieval, including an interface between the TM and a real-time network intrusion detection system (NIDS). The NIDS controls the TM by dynamically adjusting recording parameters, instructing it to permanently store suspicious activity for offline forensics, and fetching traffic from the past for retrospective analysis. We present a detailed performance evaluation of both stand-alone and joint setups, and report on experiences with running the system live in high-volume environments.}, address = {New York, NY, USA}, author = {Maier, Gregor and Sommer, Robin and Dreger, Holger and Feldmann, Anja and Paxson, Vern and Schneider, Fabian}, booktitle = {SIGCOMM '08: Proceedings of the ACM SIGCOMM 2008 conference on Data communication}, citeulike-article-id = {4171547}, citeulike-linkout-0 = {http://portal.acm.org/citation.cfm?id=1402958.1402980}, citeulike-linkout-1 = {http://dx.doi.org/10.1145/1402958.1402980}, doi = {10.1145/1402958.1402980}, isbn = {978-1-60558-175-0}, keywords = {security}, location = {Seattle, WA, USA}, pages = {183--194}, posted-at = {2009-03-13 14:50:13}, priority = {2}, publisher = {ACM}, title = {Enriching network security analysis with time travel}, url = {http://dx.doi.org/10.1145/1402958.1402980}, year = {2008} }

TY - CONF ID - Maier08Enriching L3 - citeulike-article-id:4171547 N2 - In many situations it can be enormously helpful to archive the raw contents of a network traffic stream to disk, to enable later inspection of activity that becomes interesting only in retrospect. We present a Time Machine (TM) for network traffic that provides such a capability. The TM leverages the heavy-tailed nature of network flows to capture nearly all of the likely-interesting traffic while storing only a small fraction of the total volume. An initial proof-of-principle prototype established the forensic value of such an approach, contributing to the investigation of numerous attacks at a site with thousands of users. Based on these experiences, a rearchitected implementation of the system provides flexible, highperformance traffic stream capture, indexing and retrieval, including an interface between the TM and a real-time network intrusion detection system (NIDS). The NIDS controls the TM by dynamically adjusting recording parameters, instructing it to permanently store suspicious activity for offline forensics, and fetching traffic from the past for retrospective analysis. We present a detailed performance evaluation of both stand-alone and joint setups, and report on experiences with running the system live in high-volume environments. CY - Seattle, WA, USA SN - 978-1-60558-175-0 AD - New York, NY, USA EP - 194 TI - Enriching network security analysis with time travel PB - ACM T2 - SIGCOMM '08: Proceedings of the ACM SIGCOMM 2008 conference on Data communication SP - 183 KW - security AU - Maier, Gregor AU - Sommer, Robin AU - Dreger, Holger AU - Feldmann, Anja AU - Paxson, Vern AU - Schneider, Fabian PY - 2008/// UR - http://dx.doi.org/10.1145/1402958.1402980 ER -