Faculty of Information Technology, BUT

Publication Details

ASNM: Advanced Security Network Metrics for Attack Vector Description

HOMOLIAK Ivan, BARABAS Maroš, CHMELAŘ Petr, DROZD Michal and HANÁČEK Petr. ASNM: Advanced Security Network Metrics for Attack Vector Description. In: Proceedings of the 2013 International Conference on Security & Management. Las Vegas: Computer Science Research, Education, and Applications Press, 2013, pp. 350-358. ISBN 1-60132-259-3.
Czech title
ASNM: Pokročilé bezpečnostní síťové metriky pro popis vektorů útoků
Type
conference paper
Language
english
Authors
Homoliak Ivan, Ing., Ph.D. (DITS FIT BUT)
Barabas Maroš, Ing., Ph.D. (DITS FIT BUT)
Chmelař Petr, Ing. (DIFS FIT BUT)
Drozd Michal, Ing. (DITS FIT BUT)
Hanáček Petr, doc. Dr. Ing. (DITS FIT BUT)
Keywords
behavioral signature, detection, IDS, network metrics, security
Abstract
The main goal of this paper was to present formal description of metrics extraction process with respect to a communication context. Then there was defined the set of metrics included in the final behavioral signature. Second part of the paper describes experiments performed with the state-of-the-art set of network metrics designed by A. Moore, which were compared to our proposed experimental set.
Annotation
There is considerable interest in developing novel detection methods based on new metrics for description of network flow to identify connection characteristics, for instance to permit early identification of emerging security incidents, rapid detection of infections within internal networks, or instantaneous prevention of forming attacks. In this paper we propose a method for extraction data from network flow and contextual separation of partial connections using set of network metrics that create a signature defining the connection behavior. We begin with definition of input dataset of captured communication and the process of extraction metrics from separated connections. Then we define the set of metrics included in the final behavioral signature. Second part of the article describes experiments performed with the state-of-the-art set of network metrics with comparison to our proposed experimental set. The paper is concluded with the experiment results.
Published
2013
Pages
350-358
Proceedings
Proceedings of the 2013 International Conference on Security & Management
Conference
The 2013 International Conference on Security and Management, Las Vegas, US
ISBN
1-60132-259-3
Publisher
Computer Science Research, Education, and Applications Press
Place
Las Vegas, US
BibTeX
@INPROCEEDINGS{FITPUB10248,
   author = "Ivan Homoliak and Maro\v{s} Barabas and Petr Chmela\v{r} and Michal Drozd and Petr Han\'{a}\v{c}ek",
   title = "ASNM: Advanced Security Network Metrics for Attack Vector Description",
   pages = "350--358",
   booktitle = "Proceedings of the 2013 International Conference on Security \& Management",
   year = 2013,
   location = "Las Vegas, US",
   publisher = "Computer Science Research, Education, and Applications Press",
   ISBN = "1-60132-259-3",
   language = "english",
   url = "https://www.fit.vut.cz/research/publication/10248"
}
Files
Back to top