Sciweavers

DISCEX
2003
IEEE

Surveillance Detection in High Bandwidth Environments

14 years 4 months ago
Surveillance Detection in High Bandwidth Environments
In this paper, we describe System Detection’s surveillance detection techniques for enclave environments (ESD) and peering center environments (PSD) and evaluate each technique over data gathered from two different network environments. ESD is evaluated over 74 hours of tcpdump packet traces (344 million packets) from a large enclave; PSD is evaluated over 5 hours of tcpdump packet traces (110 million packets) gathered from a peering center. Both surveillance detection modules were executed over the audit data offline to generate surveillance detection alerts, though the systems can be run in real-time as well. Our results show that both ESD and PSD accurately discover great quantities of surveillance activities (including long-lived and distributed scans) and can be tuned to reduce the volume of alerts. Furthermore, existing IDS technology may be blind to many activities discovered by ESD and PSD.
Seth Robertson, Eric V. Siegel, Matthew Miller, Sa
Added 04 Jul 2010
Updated 04 Jul 2010
Type Conference
Year 2003
Where DISCEX
Authors Seth Robertson, Eric V. Siegel, Matthew Miller, Salvatore J. Stolfo
Comments (0)