Surveillance Detection in High Bandwidth Environments
In this paper, we describe System Detection's surveillance detection techniques for enclave environments (ESD) and peering center environments (PSD) and evaluate each technique over data gathered from two different network environments. ESD is evaluated over 74 hours of tcpdump packet traces (344 million packets) from a large enclave; PSD is evaluated over 5 hours of tcpdump packet traces (110 million packets) gathered from a peering center. Both surveillance detection modules were executed over the audit data offline to generate surveillance detection alerts, though the systems can be run in real-time as well. Our results show that both ESD and PSD accurately discover great quantities of surveillance activities (including long-lived and distributed scans) and can be tuned to reduce the volume of alerts. Furthermore, existing IDS technology may be blind to many activities discovered by ESD and PSD.
- SD-DiscexIII.pdf application/pdf 256 KB Download File
Also Published In
More About This Work
- Academic Units
- Computer Science
- Published Here
- April 30, 2010
Proceedings: DARPA Information Survivability Conference and Exposition: Washington, DC, April 22-24, 2003, vol. 1 (Los Alamitos, Calif.: IEEE Computer Society, 2003), pp. 130-138.