Global Intrusion Detection in the DOMINO Overlay System.

摘要: Sharing data between widely distributed intrusion detection systems offers the possibility of significant improvements in speed and accuracy over isolated systems. In this paper, we describe evaluate DOMINO (Distributed Overlay for Monitoring InterNet Outbreaks); an architecture a system that fosters collaboration among heterogeneous nodes organized as overlay network. The design enables to be heterogeneous, scalable, robust attacks failures. An important component DOMINO’s is use active-sink which respond measure connections unused IP addresses. This efficient from spoofed sources, reduces false positives, attack classification production timely blacklists. We capabilities performance using large set logs collected 1600 providers across Internet. Our analysis demonstrates marginal benefit obtained sources coordinated through like DOMINO. also how configure order maximize gains perspectives blacklist length, freshness proximity. perform retrospective on 2002 SQL-Snake 2003 SQL-Slammer epidemics highlights information exchange would have reduced reaction time false-alarm rates during outbreaks. Finally, provide preliminary results our prototype deployment illustrates limited variability sink traffic feasibility discrimination types. ∗The U.S. Government authorized reproduce distribute reprints Governmental purposes, notwithstanding any copyright notices affixed thereon. views conclusions contained herein are those authors, should not interpreted necessarily representing official policies or endorsements, either expressed implied, above government agencies Government.