学位论文详细信息
Understanding and defending against internet infrastructures supporting cybecrime operations
Network security;AS reputation;Bulletproof hosting;Cybercrime;Network operations;Cybercrime infrastructures
Konte, Maria ; Feamster, Nick Computer Science Perdisci, Roberto Lee, Wenke Zegura, Ellen Antonakakis, Manos ; Feamster, Nick
University:Georgia Institute of Technology
Department:Computer Science
关键词: Network security;    AS reputation;    Bulletproof hosting;    Cybercrime;    Network operations;    Cybercrime infrastructures;   
Others  :  https://smartech.gatech.edu/bitstream/1853/54424/1/KONTE-DISSERTATION-2015.pdf
美国|英语
来源: SMARTech Repository
PDF
【 摘 要 】
Today's cybercriminals must carefully manage their network resources to evade detection and maintain profitable businesses. For example, a rogue online enterprise has to have multiple technical and business components in place, to provide the necessary infrastructure to keep the business available. Often, cybercriminals in their effort to protect and maintain their valuable network resources (infrastructures), they manipulate two fundamental Internet protocols; the Domain Name System (DNS) and the Border Gateway Protocol (BGP). A popular countermeasure against cybercriminal infrastructures are Autonomous Systems (AS) reputation systems. Past research efforts have developed several AS reputation systems that monitor the traffic for illicit activities. Unfortunately, these systems have severe limitations; (1) they cannot distinguish between malicious and legitimate but abused ASes, and thus it is not clear how to use them in practice, (2) require direct observation of malicious activity, from many different vantage points and for an extended period of time, thus delaying detection. This dissertation presents empirical studies and a system that help to counteract cybecriminal infrastructures. First, we perform empirical studies that help to advance our understanding, about how these infrastructures operate. We study two representative types of infrastructures: (1) fast-flux service networks which are infrastructures based on DNS manipulation, (b) malicious ASes (hubs of cybercriminal activities) which are infrastructures that are primarily based on BGP manipulation. Second, we build on our observations from these studies, and we design and implement, ASwatch; an AS reputation system that, unlike existing approaches, monitors exclusively the routing level behavior of ASes, to expose malicious ASes sooner. We build ASwatch based on the intuition that, in an attempt to evade possible detection and remediation efforts, malicious ASes exhibit agile routing behavior (e.g. short-lived routes, aggressive re-wiring). We evaluate ASwatch on known malicious ASes, and we compare its performance to a state of the art AS reputation system.
【 预 览 】
附件列表
Files Size Format View
Understanding and defending against internet infrastructures supporting cybecrime operations 2888KB PDF download
  文献评价指标  
  下载次数:52次 浏览次数:75次