Understanding and Filtering Malicious Traffic

People

Current members

Past collaborators

Funding

Disclaimer: Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation

Problem Statement

How can we protect the network infrastructure from malicious traffic, such as scanning, malicious code propagation, and distributed denial-of-service (DDoS) attacks? We are interested in filtering-based defense systems against malicious traffic.

Filtering Algorithms. One mechanism for blocking malicious traffic is filtering: access control lists (ACLs) can selectively block traffic based on fields of the IP header. Filters (ACLs) are already available in the routers today but are a scarce resource because they are stored in the expensive ternary content addressable memory (TCAM). In this work, we develop a framework for studying filter selection as a resource allocation problem. Within this framework, we study five practical cases of source address/prefix filtering, which correspond to different attack scenarios and operator's policies. We show that filter selection optimization leads to novel variations of the multidimensional knapsack problem and we design optimal, yet computationally efficient, algorithms to solve them. We also evaluate our approach using data from Dshield.org and demonstrate that it brings significant benefits in practice. Our set of algorithms is a building block that can be immediately used by operators and manufacturers to block malicious traffic in a cost-efficient way.

Characterizing Malicious IP Behavior. In parallel, we are studying the characteristics of several publicly available blacklists (such as Spamhaus) and IDS log repositories (Dshield.org) in order to understand the behavior of malicious IP sources and flows. One goal is to construct blacklists that can accurately predict the behavior of malicious sources; such blacklists will be used as input to the filtering algorithms, which can then block the malicious sources. Another goal is to automatically identify patterns of malicious behavior using flow data.

Defense Mechanisms against Phishing Sites. We developed PhishDef - a lightweight yet accurate mechanism for classifying phishing sites based only on the URL name. We are currently developing a browser plug-in that implements the algorithm on the client side.

Papers and Presentations

Click Fraud Detection
Phishing
Spam
Prediction/Blacklisting
Filtering