New directions in privacy-preserving anomaly detection for network traffic

  • Authors:

  • Giuseppe Bianchi;Simone Teofili;Matteo Pomposini

  • Affiliations:

  • University of Rome, Rome, Italy;University of Rome, Rome, Italy;University of Rome, Rome, Italy

  • Venue:
  • Proceedings of the 1st ACM workshop on Network data anonymization
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

The enormous amount of traffic data gathered by network monitoring systems poses a serious threat on the privacy of the network customers. To face this issue, this paper promotes a new approach to privacy-preserving network monitoring. With concrete reference to a simplified anomaly detection scenario, we show how a monitoring application can be decomposed in two parts running in different components. A front-end stage is devised to capture raw (unprotected) packets and process them "on-the-fly" through performance/memory efficient data structures, and specifically Counting Bloom Filters. Captured packets are then cryptographically protected and delivered to a back-end stage along with suitably designed cryptographic material determined by the output of the counting filter. The system is conceived to technically restrict decryption only to data packets which are classified as belonging to a flow for which an anomalous behavior is suspected. The remaining traffic is by construction guaranteed that no further data processing nor, to some extent, statistical analysis may occur in the system back-end. Although the anomaly detection application used as operative reference throughout this work is somewhat simplified with respect to real-world approaches, the resulting problem is significantly more complex than traditional pattern searching techniques over encrypted data. Hence, albeit preliminary and with room for improvements, we believe that our proposed approach suggests new promising research directions in privacy-preserving network monitoring.