Global Intrusion Detection in the DOMINO Overlay System

By Vinod Yegneswaran, Paul R. Barford, Somesh Jha. Network and Distributed System Security Symposium, 2004

337 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/d024d789ef35f60179456fc3a88c895d7ba9b7a2

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Fast Private Set Operations with SEPIA (2012, methodology): “Recently, privacy-preserving data correlation has also been applied successfully to network security [6, 30, 21, 34].”
Anomalous Payload-Based Worm Detection and Signature Generation (2005, background): “We posit that a collaborative security system [16] [17], a distributed detection system that automatically shares information in real-time about anomalous behavior experienced at the moment of attack among collaborating sites, will substantially improve protection against wide-scale infections.”
A survey of coordinated attacks and collaborative intrusion detection (2010, methodology): “The DOMINO project (Yegneswaran et al., 2004; Barford and Jha, 2004) is a distributed CIDS that aims to monitor Internetscale outbreaks.”
When Intrusion Detection Meets Blockchain Technology: A Review (2018, background): “[22] V. Yegneswaran, P. Barford, and S. Jha ‘‘Global intrusion detection in the DOMINO overlay system,’’ in Proc.”
Taxonomy and Survey of Collaborative Intrusion Detection (2015, methodology): “In this direction, approaches such as DOMINO and the Trust-aware CIDS provide some promising and interesting properties [Yegneswaran et al. 2004; Duma et al. ].”
SEPIA: Privacy-Preserving Aggregation of Multi-Domain Network Events and Statistics (2010, methodology): “[49] presented DOMINO, a distributed IDS that enables collaboration among nodes.”
Modeling Botnet Propagation Using Time Zones (2006, background): “Distributed sensing projects [Ull05, YBJ04 , Par04] can take some credit for helping reduce the response time for worms to hours instead of days.”
The Internet Motion Sensor - A Distributed Blackhole Monitoring System (2005, background): “By either watching firewall logs, looking for policy violations, or by aggregating IDS alerts across multiple enterprises [20, 34], one can infer information regarding a worm’s spread.”
CloudAV: N-Version Antivirus in the Network Cloud (2008, background): “In addition, there have been several attempts to provide network services as overlay networks [29, 33].”
Collaborative Security (2015, methodology): “Messages shared in the system can be encrypted or hashed to avoid counterfeit messages as shown in [Janakiraman et al. 2003; Yegneswaran et al. 2004].”