Payload attribution via hierarchical bloom filters

Payload attribution is an important problem often encountered in network forensics. Given an excerpt of a payload, finding its source and destination is useful for many security applications such as identifying sources and victims of a worm or virus. Although IP traceback techniques have been proposed in the literature, these techniques cannot help when we do not have the entire packet or when we only have an excerpt of the payload. In this paper, we present a payload attribution system (PAS) that attributes reasonably long excerpts of payloads to their source and/or destination hosts. The system we propose is based on a novel data structure called a Hierarchical Bloom Filter (HBF). An HBF creates compact digests of payloads and provides probabilistic answers to membership queries on the excerpts of payloads. We also present the performance analysis of the method and experimental results from a prototype demonstrating the practicality and efficacy of the system. The system can reliab...

• Type: Conference
• Year: 2004
• Where: CCS
• Authors: Kulesh Shanmugasundaram, Hervé Brönnimann, Nasir D. Memon
• Keywords: CCS 2004, IP Traceback Techniques, Payload Attribution, Security Privacy, Source And/or Destination