Internet intrusions: global characteristics and prevalence

By Vinod Yegneswaran, Paul R. Barford, Johannes Ullrich. Measurement and Modeling of Computer Systems, 2003

297 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/70db369ba1a0b3dc437c0930606b33518a760838

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Global Intrusion Detection in the DOMINO Overlay System (2004, background): “The inducement for the satellites is a global vantage point that allows for rapid outbreak recognition, dynamic content filtering and application specific source blacklisting to protect their networks in a timely manner.”
An empirical evaluation of entropy-based traffic anomaly detection (2008, background): “Other research efforts in the space of fine-grained anomaly detection have focused on measurements and analysis of backscatter and honeypot data [33], identifying heavy-hitters [5, 34], fast scanner detection [9] etc.”
Characterization of network-wide anomalies in traffic flows (2004, background): “Researchers have characterized Inter net intrusion activity [24], failure events in IP networks [17], and also constructed taxonomies for Internet wo rms [23], denial of service attacks [9] and defenses [18].”
Fast portscan detection using sequential hypothesis testing (2004, background): “Thus, we do not aim to detect “distributed” scans [9].”
A taxonomy of DDoS attack and DDoS defense mechanisms (2004, methodology): “Based on the degree of automation, we di(cid:11)erentiate between manual , semi-automatic and automatic DDoS attacks.”
An Inside Look at Botnets (2007, methodology): “In [40], firewall and intrusion detection system logs collected from sites distributed thr oughout the Internet are used to characterize global attack activity.”
Honeypots: catching the insider threat (2003, background): “In their publication Internet Intrusions: Global Characteristics and Prevalence[6], they estimate 25 billion intrusion attempts per day, based on 1600 firewall logs collected over a four month period.”
Structural analysis of network traffic flows (2004, background): “However, a wide range of important problems fa ced by network researchers today require modeling and analysis of traffic on all links simulta neously, including traffic engineering, traffic matrix estimation [17, 31, 32], anomaly detection [6 , 1], attack detection [30], traffic forecasting and capa”
Characteristics of internet background radiation (2004, background): “explore the statistical characteristics of Internet attac k nd intrusion activity from a global perspective [43].”