Improving Payload Attribution Techniques in Computer Network Criminology with Time based Hierarchical Bloom Filter

Q: How can I download an article?

To download an article from SID, first log in to the site, search for the article title, and click on the 'Download Article' option.

Q: How can I download an ISI article?

To download an ISI article on SID, enter the keyword or article title in the search bar, view the relevant results, click on the desired article, and select the 'Download Article' option.

Q: How can I access the SID database?

To access the SID database, visit SID.ir, create an account, and log in to access scientific resources.

Q: Is downloading articles from SID free?

Some articles on SID are available for free, while others require payment. Details are specified on the article's page.

Sasan Z.; KHARAZI M.

مرکز اطلاعات علمی Scientific Information Database (SID) - Trusted Source for Research and Academic Resources

Journal Paper

Paper Information

Journal: JOURNAL OF ELECTRONIC AND CYBER DEFENCE Year:2019 | Volume:7 | Issue:3 Page(s): 71-81

Download Full-Text

Persian Verion

View:

472

Download:

Cites:

Information Journal Paper

Title

Improving Payload Attribution Techniques in Computer Network Criminology with Time based Hierarchical Bloom Filter

Author(s)

Sasan Z. | KHARAZI M. | Issue Writer Certificate

Keywords

Network ForensicsQ1

Payload AttributionQ1

Abstract

In the light of increased network attacks, Payload Attribution is an essential part of any forensics analysis of the attack. Usually attribution has to be done based on the payload of the packets. In such techniques network traffic should be stored in its entirety while user privacy is preserved. Bloom filters have been an ideal tool for such requirements. Previous works in this area have tried to minimize the false positive error rate associated with the bloom filter while improving on the data reduction ratio but there has not been any notable research on practical implementations in computer networks. A Payload Attribution technique should provide a list of connections which are suspects of carrying a specific payload (i. e. malware signature). The problem arises with the fact that there are too many queries required, given the large number of connections and the number of bloom filters involved over long time periods, which results in a large aggregate error rate. In this work, we propose a technique with which a time-based hierarchical bloom filter configuration is proposed to tackle the noted problem. Our evaluation shows that with this proposed technique we are able to limit the false positive error rate of the system as compared to the previously proposed techniques. This leads to an overall error reduction in the Payload Attribution system. More specifically, the error rate compared to previous work drops from 5. 66% to 3. 98% which results in reducing the number of incorrectly identified flows by 8400.

Cites

No record.

References

No record.

Cite

APA: Copy

Sasan, Z., & KHARAZI, M.. (2019). Improving Payload Attribution Techniques in Computer Network Criminology with Time based Hierarchical Bloom Filter. JOURNAL OF ELECTRONIC AND CYBER DEFENCE, 7(3 ), 71-81. SID. https://sid.ir/paper/358519/en

Vancouver: Copy

Sasan Z., KHARAZI M.. Improving Payload Attribution Techniques in Computer Network Criminology with Time based Hierarchical Bloom Filter. JOURNAL OF ELECTRONIC AND CYBER DEFENCE[Internet]. 2019;7(3 ):71-81. Available from: https://sid.ir/paper/358519/en

IEEE: Copy

Z. Sasan, and M. KHARAZI, “Improving Payload Attribution Techniques in Computer Network Criminology with Time based Hierarchical Bloom Filter,” JOURNAL OF ELECTRONIC AND CYBER DEFENCE, vol. 7, no. 3 , pp. 71–81, 2019, [Online]. Available: https://sid.ir/paper/358519/en

Related Journal Papers