- Title
- Adaptable exploit detection through scalable netflow analysis
- Creator
- Herbert, Alan, Irwin, Barry V W
- Date
- 2016
- Type
- text
- Type
- article
- Identifier
- http://hdl.handle.net/10962/429274
- Identifier
- vital:72572
- Identifier
- https://ieeexplore.ieee.org/abstract/document/7802938
- Description
- Full packet analysis on firewalls and intrusion detection, although effective, has been found in recent times to be detrimental to the overall performance of networks that receive large volumes of throughput. For this reason partial packet analysis technologies such as the NetFlow protocol have emerged to better mitigate these bottlenecks through log generation. This paper researches the use of log files generated by NetFlow version 9 and IPFIX to identify successful and unsuccessful exploit attacks commonly used by automated systems. These malicious communications include but are not limited to exploits that attack Microsoft RPC, Samba, NTP (Network Time Protocol) and IRC (Internet Relay Chat). These attacks are recreated through existing exploit implementations on Metasploit and through hand-crafted reconstructions of exploits via known documentation of vulnerabilities. These attacks are then monitored through a preconfigured virtual testbed containing gateways and network connections commonly found on the Internet. This common attack identification system is intended for insertion as a parallel module for Bolvedere in order to further the increase the Bolvedere system's attack detection capability.
- Format
- 7 pages, pdf
- Language
- English
- Relation
- Information Security for South Africa (ISSA), Herbert, A. and Irwin, B., 2016, August. Adaptable exploit detection through scalable netflow analysis. In 2016 Information Security for South Africa (ISSA) (pp. 121-128). IEEE, Information Security for South Africa (ISSA) volume 2016 number 1 121 128 2016 Conference
- Rights
- Publisher
- Rights
- Use of this resource is governed by the terms and conditions of the IEEE Xplore Terms of Use Statement (https://ieeexplore.ieee.org/Xplorehelp/overview-of-ieee-xplore/terms-of-use)
- Hits: 57
- Visitors: 60
- Downloads: 5
Thumbnail | File | Description | Size | Format | |||
---|---|---|---|---|---|---|---|
View Details | SOURCE1 | Adaptable exploit detection through scalable netflow analysis.pdf | 688 KB | Adobe Acrobat PDF | View Details |