Fingerprinting Network Entities Based on Traffic Analysis in High-Speed Network Environment
Joint Authors
Ling, Zhen
Yang, Ming
Gu, Xiaodan
Zhang, Yiting
Pan, Peilong
Source
Security and Communication Networks
Issue
Vol. 2018, Issue 2018 (31 Dec. 2018), pp.1-15, 15 p.
Publisher
Hindawi Publishing Corporation
Publication Date
2018-12-16
Country of Publication
Egypt
No. of Pages
15
Main Subjects
Information Technology and Computer Science
Abstract EN
For intrusion detection, it is increasingly important to detect the suspicious entities and potential threats.
In this paper, we introduce the identification technologies of network entities to detect the potential intruders.
However, traditional entities identification technologies based on the MAC address, IP address, or other explicit identifiers can be deactivated if the identifier is hidden or tampered.
Meanwhile, the existing fingerprinting technology is also restricted by its limited performance and excessive time lapse.
In order to realize entities identification in high-speed network environment, PFQ kernel module and Storm are used for high-speed packet capture and online traffic analysis, respectively.
On this basis, a novel device fingerprinting technology based on runtime environment analysis is proposed, which employs logistic regression to implement online identification with a sliding window mechanism, reaching a recognition accuracy of 77.03% over a 60-minute period.
In order to realize cross-device user identification, Web access records, domain names in DNS responses, and HTTP User-Agent information are extracted to constitute user behavioral fingerprints for online identification with Multinomial Naive Bayes model.
When the minimum effective feature dimension is set to 9, it takes only 5 minutes to reach an accuracy of 79.51%.
Performance test results show that the proposed methods can support over 10Gbps traffic capture and online analysis, and the system architecture is justified in practice because of its practicability and extensibility.
American Psychological Association (APA)
Gu, Xiaodan& Yang, Ming& Zhang, Yiting& Pan, Peilong& Ling, Zhen. 2018. Fingerprinting Network Entities Based on Traffic Analysis in High-Speed Network Environment. Security and Communication Networks،Vol. 2018, no. 2018, pp.1-15.
https://search.emarefa.net/detail/BIM-1214266
Modern Language Association (MLA)
Gu, Xiaodan…[et al.]. Fingerprinting Network Entities Based on Traffic Analysis in High-Speed Network Environment. Security and Communication Networks No. 2018 (2018), pp.1-15.
https://search.emarefa.net/detail/BIM-1214266
American Medical Association (AMA)
Gu, Xiaodan& Yang, Ming& Zhang, Yiting& Pan, Peilong& Ling, Zhen. Fingerprinting Network Entities Based on Traffic Analysis in High-Speed Network Environment. Security and Communication Networks. 2018. Vol. 2018, no. 2018, pp.1-15.
https://search.emarefa.net/detail/BIM-1214266
Data Type
Journal Articles
Language
English
Notes
Includes bibliographical references
Record ID
BIM-1214266