Mediating Cross-Domain Network Threat in Cooperative Way

Abstract:

Network attacks, either in aggressive or silent way, are main threat to network security. Modern network environment normally involves multiple domains, and there are connections between them, so an adversary can impact the important network domain via attacking a normal one. When the threat is found in one domain, there isnt a mean to identify how large scale this threat has spread, and there isnt an effective method to mediate such threat. This paper focused on detecting the real topology of multi-domain network and proposed a cooperative method to mediate the threat propagation. The network topology is identified by tracing the propagation of designed benign worm, and the cooperative method is based on novelly collaborating local firewalls on hosts. Performance evaluation is given at the end of this paper to demonstrate the feasibility and effectiveness of the proposed measure.

• Periodical: Applied Mechanics and Materials (Volumes 530-531)
• Pages: 671-676
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.530-531.671
• Online since: February 2014
• Authors: Hua Yang Cao*, Pei Dong Zhu, Wen Qi Bi
• Keywords: Benign Worm, Cooperative Defense, Network Security

References

[1] Donnet, Benoit, and Timur Friedman. Internet topology discovery: a survey., Communications Surveys & Tutorials, IEEE 9. 4 (2007): 56-69.

DOI: 10.1109/comst.2007.4444750

[2] Stallings, William. SNMP, SNMPv2, SNMPv3, and RMON 1 and 2. Addison-Wesley Longman Publishing Co., Inc., (1998).

[3] Breitbart, Yuri, et al. Topology discovery in heterogeneous IP networks., INFOCOM 2000. Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings. IEEE. Vol. 1. IEEE, (2000).

DOI: 10.1109/infcom.2000.832196

[4] Lowekamp, Bruce, David O'Hallaron, and Thomas Gross. Topology discovery for large ethernet networks., ACM SIGCOMM Computer Communication Review. Vol. 31. No. 4. ACM, (2001).

DOI: 10.1145/964723.383078

[5] Bejerano, Yigal, et al. Physical topology discovery for large multisubnet networks., INFOCOM 2003. Twenty-Second Annual Joint Conference of the IEEE Computer and Communications. IEEE Societies. Vol. 1. IEEE, (2003).

DOI: 10.1109/infcom.2003.1208686

[6] Keromytis, Angelos D., Vishal Misra, and Daniel Rubenstein. Using overlays to improve network security., ITCom 2002: The Convergence of Information Technologies and Communications. International Society for Optics and Photonics, (2002).

[7] Ferguson, Paul. Network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing., (2000). Information on http: /www. ietf. org/rfc/rfc2267. txt.

DOI: 10.17487/rfc2827

[8] Park, Kihong, and Heejo Lee. On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets., ACM SIGCOMM Computer Communication Review. Vol. 31. No. 4. ACM, (2001).

DOI: 10.1145/964723.383061

[9] Peng, Tao, Christopher Leckie, and Kotagiri Ramamohanarao. Protection from distributed denial of service attacks using history-based IP filtering. " Communications, 2003. ICC, 03. IEEE International Conference on. Vol. 1. IEEE, (2003).

DOI: 10.1109/icc.2003.1204223

[10] Zhang, Guangsen, and Manish Parashar. Cooperative detection and protection against network attacks using decentralized information sharing., Cluster Computing 13. 1 (2010): 67-86.

DOI: 10.1007/s10586-009-0116-9

[11] DShield. org: Distributed intrusion detection system. November 2000. Information on http: /www. dshield. org.