Predavanje "Botnet Detection and Real-World Aspects of Internet Traffic Monitoring and Analysis"

Sažetak predavanja:

The growing ubiquity and diversity of Internet usage continuously set higher requirements at security-related network monitoring. Increasing amounts of both benign and malicious traffic complicate both the collection as well as the analysis. The main Internet security threats (as e.g. Distributed Denial of Service (DDoS) and unsolicited communication (UC)) are distributed in nature and have severe effects on the operators' own network operations, as they cause large-scale disruptions and high cost. At the same time, (the paying) end-users expect extremely high service availability, which forbids over-cautious security measures. Therefore, new approaches are needed that scale to very large datasets and thereby consider the properties of the diverse benign 'background' traffic, in order to provide more accurate characterizations of ongoing malicious activities.

In this talk, I give an overview of our view on mandatory design requirements for such monitoring approaches. I'll discuss the nature of Internet traffic and the implications on the design of anomaly detection algorithms. In this context, I'll furthermore introduce the fundamental functionalities of botnets and give an overview of our recent activities in this field. Specifically, I'll point out relevant usage scenarios for FER's IMUNES network emulator.

Kratka biografija:

Andreas Berger received his M.Sc. degree in Telematik from Graz University of Technology in 2007 and is now working towards his Ph.D. at University of Vienna. He joined Forschungszentrum Telekommunikation Wien in 2007 and currently holds a position as junior researcher. His main research interests are in network security, statistical anomaly detection, and complex network theory.