MULAN: Multi-Level Adaptive Network filter

Shimrit Tzur-David*, Danny Dolev, Tal Anker

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

3 Scopus citations

Abstract

A security engine should detect network traffic attacks at line-speed. When an attack is detected, a good security engine should screen away the offending packets and continue to forward all other traffic. Anomaly detection engines must protect the network from new and unknown threats before the vulnerability is discovered and an attack is launched. Thus, the engine should integrate intelligent "learning" capabilities. The principal way for achieving this goal is to model anticipated network traffic behavior, and to use this model for identifying anomalies. The scope of this research focuses primarily on denial of service (DoS) attacks and distributed DoS (DDoS). Our goal is detection and prevention of attacks. The main challenges include minimizing the false-positive rate and the memory consumption. In this paper, we present the MULAN-filter. The MULAN (MUlti-Level Adaptive Network) filter is an accurate engine that uses multi-level adaptive structure for specifically detecting suspicious traffic using a relatively small memory size.

Original languageEnglish
Title of host publicationSecurity and Privacy in Communication Networks - 5th International ICST Conference, SecureComm 2009, Revised Selected Papers
Pages71-90
Number of pages20
DOIs
StatePublished - 2009
Event5th International ICST Conference on Security and Privacy in Communication Networks, SecureComm 2009 - Athens, Greece
Duration: 14 Sep 200918 Sep 2009

Publication series

NameLecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering
Volume19 LNICST
ISSN (Print)1867-8211

Conference

Conference5th International ICST Conference on Security and Privacy in Communication Networks, SecureComm 2009
Country/TerritoryGreece
CityAthens
Period14/09/0918/09/09

Fingerprint

Dive into the research topics of 'MULAN: Multi-Level Adaptive Network filter'. Together they form a unique fingerprint.

Cite this