A collaborative event processing system for protection of critical infrastructures from cyber attacks

Authors:
Leonardo Aniello;Giuseppe Antonio Di Luna;Giorgia Lodi;Roberto Baldoni
Affiliations:
University of Rome "La Sapienza", Rome, Italy;University of Rome "La Sapienza", Rome, Italy;University of Rome "La Sapienza", Rome, Italy;University of Rome "La Sapienza", Rome, Italy
Venue:
SAFECOMP'11 Proceedings of the 30th international conference on Computer safety, reliability, and security
Year:
2011

Citing 5
Cited 2

A scalable application placement controller for enterprise data centers

Proceedings of the 16th international conference on World Wide Web
Diagnosing network disruptions with network-wide analysis

Proceedings of the 2007 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
Forensic Analysis for Epidemic Attacks in Federated Networks

ICNP '06 Proceedings of the Proceedings of the 2006 IEEE International Conference on Network Protocols
Plan-based complex event detection across distributed sources

Proceedings of the VLDB Endowment
Inter-domain stealthy port scan detection through complex event processing

EWDC '11 Proceedings of the 13th European Workshop on Dependable Computing

Input data organization for batch processing in time window based computations

Proceedings of the 28th Annual ACM Symposium on Applied Computing
An event-based platform for collaborative threats detection and monitoring

Information Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

We describe an Internet-based collaborative environment that protects geographically dispersed organizations of a critical infrastructure (e.g., financial institutions, telco providers) from coordinated cyber attacks. A specific instance of a collaborative environment for detecting malicious inter-domain port scans is introduced. This instance uses the open source Complex Event Processing (CEP) engine ESPER to correlate massive amounts of network traffic data exhibiting the evidence of those scans. The paper presents two inter-domain SYN port scan detection algorithms we designed, implemented in ESPER, and deployed on the collaborative environment; namely, Rank-based SYN (R-SYN) and Line Fitting. The paper shows the usefulness of the collaboration in terms of detection accuracy. Finally, it shows how Line Fitting can both achieve a higher detection accuracy with a smaller number of participants than R-SYN, and exhibit better detection latencies than R-SYN in the presence of low link bandwidths (i.e., less than 3Mbit/s) connecting the organizations to Esper.