Abstract

Traffic graph analysis has become an increasingly useful tool in network security. By summarizing the aggregate activity of a particular service or network using graph based representations, it is possible to model normal activity using a variety of different attributes which are not easily identified or exploited by attackers. In this paper, we discuss several examples of analysis using traffic graphs and demonstrate its potential for scan detection, identifying hitlist attackers, and identifying spammers.

Date

2011

Authors

M Patrick Collins

Conference

2011-MILCOM 2011 military communications conference

Pages

1333-1337

Publisher

IEEE