Military Communications and Information Technology: A Trusted ...

More documents

Recommendations

Info

394 Military Communications and Information Technology... [15] NC3B SC/4, “Information Assurance Technical and Implementation Directive on Security Management Infrastructure (SMI),” AC/322(SC/4)WP(2010)0008, 2010. [16] NAC, “NATO Policy for the Implementation of a PKI for NATO Communication and Information Systems,” Brussels, Belgium, AC/322-D(2003)005, 2003. [17] NAC, “Directive for NATO Public Key Infrastructure (NPKI) Interoperability with the Nations,” Brussels, Belgium, AC/322-D(2005)0025-REV1, 2010. [18] K. Wrona, G. Hallingstad, and S. Oudkerk, “Risk-aware and policy-compliant approach to network configuration,” in Proceedings of the 12th Military Communications and Information Systems Conference (MCC), Wroclaw, Poland, 2010. [19] H. Debar, Y. Thomas, N. Boulahia-Cuppens, and F. Cuppens, “Using Contextual Security Policies for Threat Response,” in Proceedings of the DIMVA, vol. LNCS 4064, 2006, pp. 109-128. [20] H. Debar, D. Curry, and B. Feinstein, “The Intrusion Detection Message Exchange Format (IDMEF),” IETF, RFC 4765, 2007. [21] T. Nipkow, L. Paulson, and M. Wenzel, A Proof Assistant for Higher-Order Logic.: Springer-Verlag, 2011.
Network Traffic Characteristics for Detecting Future Botnets Jonathan P. Chapman 1 , Felix Govaers 2 1 Elmar Gerhards-Padilla, Research Group Cyber Defense, Fraunhofer FKIE, Friedrich-Ebert-Allee 144, 53113 Bonn, Germany, chapman@cs.uni-bonn.de 2 Department for Sensor Data and Information Fusion, Fraunhofer FKIE, Neuenahrer Str. 20, 53343 Wachtberg, Germany, felix.govaers@fkie.fraunhofer.de Abstract: Botnets are and are likely to remain the main vehicle for online crime for the foreseeable future. To protect their business models, botnet operators constantly improve their protocols and applications to harden them against detection, analysis and takedown efforts. Our analysis suggest that future botnets will use proper encryption for their protocol messages, rendering them invisible to most deployed network intrusion detection systems. Therefore, we identify properties of botnet communications that will not be obscured by these measures. This allows us to design features which can be derived by measuring these properties and used as input to an approach for detecting systems infected with a botnet client. First measurements on network traffic generated by legitimate applications and a botnet client suggest that our features are capable of reliably discriminating between the two. Keywords: botnet; intrusion detection; netflow I. Introduction Over recent years, botnets have reached an increasing degree of attention of both general and academic public. Their versatility proved to be an enabler for a wide range of criminal business models ranging from spam delivery to phishing, blackmail and espionage, triggering counteractions by those operating networks or responsible for securing information infrastructures. Since infected machines participating in botnets are often owned by a large and diverse group of individuals and organisations, scattered over a large number of jurisdictions, their efforts were often focused on denying the operator control over its botnet, usually by shutting down their command and control servers [1]. Early botnets relied on simple centralised mechanisms for command and control, such as an IRC channel that botnet clients would join, rendering the technical part of shutting a botnet down rather simple. However, botnet operators learned that losing control over their botnets would prevent them from executing their business models. Thus, we are observing a constant evolution of their protocols and methods, trying to complicate detection, mitigation and takedown efforts.
Page 1 and 2:
Military Communications and Informa
Page 3 and 4:
Contents Foreword .................
Page 5:
Contents 5 Methodology for Gatherin
Page 8 and 9:
8 Military Communications and Infor
Page 11 and 12:
Building a Layered Enterprise Archi
Page 13 and 14:
Chapter 1: Concepts and Solutions f
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Applying NAF for Performance Analys
Page 23 and 24:
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Openness in Military Systems Jessic
Page 39 and 40:
Page 41 and 42:
Page 43 and 44:
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
The Concept of Integration Tool for
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
CFBLNet: A Coalition Capability Ena
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Selected Aspects of Effective RCIED
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81:
Page 84 and 85:
84 Military Communications and Info
Page 86 and 87:
Page 88 and 89:
Page 90 and 91:
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
100 Military Communications and Inf
Page 103:
Chapter 2 Communications and Inform
Page 106 and 107:
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
Page 116 and 117:
Page 118 and 119:
Page 120 and 121:
Page 122 and 123:
Page 124 and 125:
Page 126 and 127:
Page 128 and 129:
Page 130 and 131:
Page 132 and 133:
Page 134 and 135:
Page 136 and 137:
Page 138 and 139:
Page 140 and 141:
Page 142 and 143:
Page 144 and 145:
Page 146 and 147:
Page 149 and 150:
Use of Cross Domain Guards for CoNS
Page 151 and 152:
Chapter 2: Communications and Infor
Page 153 and 154:
Page 155 and 156:
Page 157 and 158:
Page 159:
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Page 182 and 183:
Page 184 and 185:
Page 186 and 187:
Page 188 and 189:
Page 190 and 191:
Page 192 and 193:
Page 194 and 195:
Page 196 and 197:
Page 199:
Chapter 3 Information Technology fo
Page 202 and 203:
Page 204 and 205:
Page 206 and 207:
Page 208 and 209:
Page 210 and 211:
Page 212 and 213:
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
Page 220 and 221:
Page 222 and 223:
Page 224 and 225:
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
Page 234 and 235:
Page 236 and 237:
Page 239 and 240:
Run-Time Ontology on the Basis of E
Page 241 and 242:
Chapter 3: Information Technology f
Page 243 and 244:
Page 245 and 246:
Page 247 and 248:
Page 249 and 250:
Page 251 and 252:
Page 253 and 254:
A Robust and Scalable Peer-to-Peer
Page 255 and 256:
Page 257 and 258:
Page 259 and 260:
Page 261 and 262:
Page 263 and 264:
Page 265 and 266:
Automatic Exploitation of Multiling
Page 267 and 268:
Page 269 and 270:
Page 271 and 272:
Page 273 and 274:
Page 275 and 276:
Page 277 and 278:
Page 279 and 280:
Page 281 and 282:
Information Fusion Under Network Co
Page 283 and 284:
Page 285 and 286:
Page 287 and 288:
Page 289 and 290:
Page 291 and 292:
Page 293:
Page 296 and 297:
Page 298 and 299:
Page 300 and 301:
Page 302 and 303:
Page 305 and 306:
Commanding Multi-Robot Systems with
Page 307 and 308:
Page 309 and 310:
Page 311 and 312:
Page 313 and 314:
Page 315 and 316:
Page 317 and 318:
Application of CID Server in Decisi
Page 319 and 320:
Page 321 and 322:
Page 323 and 324:
Page 325 and 326:
Page 327 and 328:
Page 329 and 330:
Page 331 and 332:
Managing Lessons Learnt from Daily
Page 333 and 334:
Page 335 and 336:
Page 337 and 338:
Page 339 and 340:
Page 341 and 342:
Page 343: Chapter 3: Information Technology f
Page 347 and 348: Federated Cyber Defence System - Ap
Page 349 and 350: Chapter 4: Information Assurance &
Page 357: Chapter 4: Information Assurance &
Page 360 and 361: 360 Military Communications and Inf
Page 377 and 378: Development of High Assurance Guard
Page 415 and 416: Methodology for Gathering Data Conc
Page 439 and 440: On Multi-Level Secure Structured Co
Page 445 and 446:
Chapter 4: Information Assurance &
Page 447 and 448:
Page 449 and 450:
Page 451 and 452:
Page 453 and 454:
Page 455 and 456:
Generation of Nonlinear Feedback Sh
Page 457 and 458:
Page 459 and 460:
Page 461 and 462:
Page 463:
Page 466 and 467:
Page 468 and 469:
Page 470 and 471:
Page 472 and 473:
Page 474 and 475:
Page 476 and 477:
Page 478 and 479:
Page 480 and 481:
Page 482 and 483:
Page 485 and 486:
Modern Usage of “Old” One-Time
Page 487 and 488:
Page 489 and 490:
Page 491 and 492:
Page 493 and 494:
Page 495:
Page 498 and 499:
Page 500 and 501:
Page 502 and 503:
Page 504 and 505:
Page 506 and 507:
Page 508 and 509:
Page 511 and 512:
A Abut Fatih 161 Akcaoglu Ismail 11
show all

Military Communications and Information Technology: A Trusted ...

Create successful ePaper yourself

Delete template?

Save as template?