Improving Payload Attribution Techniques in Computer Network Criminology with Time based Hierarchical Bloom Filter

Document Type : Original Article

Authors

Abstract

In the light of increased network attacks, payload attribution is an essential part of any forensics     analysis of the attack. Usually attribution has to be done based on the payload of the packets. In such    techniques network traffic should be stored in its entirety while user privacy is preserved. Bloom filters have been an ideal tool for such requirements. Previous works in this area have tried to minimize the false     positive error rate associated with the bloom filter while improving on the data reduction ratio but there has not been any notable research on practical implementations in computer networks. A payload           attribution technique should provide a list of connections which are suspects of carrying a specific payload (i.e. malware signature). The problem arises with the fact that there are too many queries required, given the large number of connections and the number of bloom filters involved over long time periods, which results in a large aggregate error rate. In this work, we propose a technique with which a time-based     hierarchical bloom filter configuration is proposed to tackle the noted problem. Our evaluation shows that with this proposed technique we are able to limit the false positive error rate of the system as compared to the previously proposed techniques. This leads to an overall error reduction in the payload attribution   system. More specifically, the error rate compared to previous work drops from 5.66% to 3.98% which  results in reducing the number of incorrectly identified flows by 8400.
 

Keywords

References

[1]     E. S. Pilli, R. C. Joshi, and R. Niyogi, "Network forensic frameworks: Survey and research challenges", digital investigation, vol. 7, pp. 14-27, 2010.##
[2]     K. Shanmugasundaram, H. Brönnimann, and N. Memon, "Payload attribution via hierarchical bloom filters", in Proceedings of the 11th ACM Conference on Computer and Communications Security, Washington, DC, USA, pp. 31-41, 2004.##
[3]     D. D. Clark and S. Landau, "Untangling attribution", Harv. Nat'l Sec. J., vol. 2, pp. 323-353, 2011.##
[4]     B. H. Bloom, "Space/time trade-offs in hash coding with allowable errors", Communications of the ACM, vol. 13, pp. 422-426, 1970.##
[5]     A. Almulhem and I. Traore, "A survey of connection-chains detection techniques", in 2007 IEEE Pacific Rim Conference on Communications, Computers and Signal Processing, Victoria, B.C., Canada, pp. 219-222, 2007.##
[6]     S. C. Lee and C. Shields, "Challenges to automated attack traceback", IT professional, vol. 4, pp. 12-18, 2002.##
[7]     A. Mairh, D. Barik, K. Verma, and D. Jena, "Honeypot in network security: a survey", in International conference on communication, computing & security, ODISHA, India, pp. 600-605, 2011.##
[8]     A. C. Snoeren, C. Partridge, L. A. Sanchez, C. E. Jones, F. Tchakountio, S. T. Kent, et al., "Hash-based IP traceback," ACM SIGCOMM Computer Communication Review, vol. 31, pp. 3-14, 2001.##
[9]     C. Gong and K. Sarac, "IP traceback based on packet marking and logging", in IEEE International Conference on Communications, Seoul, Korea, pp. 1043-1047, 2005.##
[10]  S. M. Bellovin, M. Leech, and T. Taylor, "ICMP traceback messages", Internet draft: draftietfitrace 03. txt, 2003.##
[11]  C. Gong and K. Sarac, "IP traceback based on packet marking and logging", in IEEE International Conference on Communications, Seoul, Korea, pp. 1043-1047, 2005.##
 [12]  L. Fan, P. Cao, J. Almeida, and A. Z. Broder, "Summary cache: a scalable wide-area web cache sharing protocol", IEEE/ACM Transactions on Networking (TON), vol. 8, pp. 281-293, 2000.##
[13]  F. M. Cuenca-Acuna, C. Peery, R. P. Martin, and T. D. Nguyen, "Planetp: Using gossiping to build content addressable peer-to-peer information sharing communities", in High Performance Distributed Computing, 2003. Proceedings. 12th IEEE International Symposium on, pp. 236-246, 2003.##
[14]  A. Broder and M. Mitzenmacher, "Network applications of bloom filters: A survey", Internet mathematics, vol. 1, pp. 485-509, 2004.##
[15]  K. Shanmugasundaram, N. Memon, A. Savant, and H. Bronnimann, "ForNet: A distributed forensics network", in International Workshop on Mathematical Methods, Models, and Architectures for Computer Network Security, Petersburg, Russia, pp. 1-16, 2003.##
[16]  M. Ponec, P. Giura, J. Wein, and H. Brönnimann, "New payload attribution methods for network forensic investigations", ACM Transactions on Information and System Security (TISSEC), vol. 13, pp. 15-47, 2010.##
[17]  Chen, Yan, et al. "CAS: Content Attribution System for Network Forensics." International Conference on Trustworthy Computing and Services. Springer, Berlin, Heidelberg, 2014.##
[18]  Wei, Yichen, et al. "Winnowing multihashing structure with wildcard query." Asia-Pacific Web Conference. Springer, Cham, 2014.##
[19]  Hosseini, S. Mohammad, and Amir Hossein Jahangir. "An Effective Payload Attribution Scheme for Cybercriminal Detection Using Compressed Bitmap Index Tables and Traffic Downsampling." IEEE Transactions on Information Forensics and Security 13.4 (2018): 850-860.##
[20]  M. H. Haghighat, M. Tavakoli, and M. Kharrazi, "Payload attribution via character dependent multi-bloom filters", IEEE Transactions on Information Forensics and Security, vol. 8, pp. 705-716, 2013.##
[21]  L. Zhang and Y. Guan, "TOPO: A topology-aware single packet attack traceback scheme", in Securecomm and Workshops, Securecomm and Workshops, 2006, pp. 1-10, 2006.##
Electronic and Cyber Defense
Volume 7, Issue 3 - Serial Number 23
November 2019
Pages 71-81

Files

History

  • Receive Date: 10 September 2018
  • Accept Date: 05 March 2019
  • Publish Date: 23 October 2019

Share

How to cite

Statistics