An integrated solution for policy filtering and traffic anomaly detection

Zhijun Wang; Hao Che; Jiannong Cao

doi:10.1007/978-3-540-69295-9_11

An integrated solution for policy filtering and traffic anomaly detection

Zhijun Wang, Hao Che, Jiannong Cao

Research output: Chapter in book / Conference proceeding › Conference article published in proceeding or book › Academic research › peer-review

Abstract

In this paper, we propose a Ternary Content Addressable Memory (TCAM) coprocessor based solution for high speed, integrated policy filtering and TCP flow anomaly detection. In the proposed solution, the TCP flow anomaly is detected through two dimensional (2D) matching. The key features of the solution include: (1) setting flag bits in TCAM action code to support various packet treatments; (2) managing TCP flow state in pair to do 2D matching. The solution's ability for detecting TCP-based flooding attacks based on real-world-trace simulations are conducted. The results show that the proposed solution can match up OC-192 line rate while doing the integrated tasks.

Original language	English
Title of host publication	Autonomic and Trusted Computing - 5th International Conference, ATC 2008, Proceedings
Pages	106-120
Number of pages	15
DOIs	https://doi.org/10.1007/978-3-540-69295-9_11
Publication status	Published - 4 Aug 2008
Event	5th International Conference on Autonomic and Trusted Computing, ATC 2008 - Oslo, Norway Duration: 23 Jun 2008 → 25 Jun 2008

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	5060 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	5th International Conference on Autonomic and Trusted Computing, ATC 2008
Country/Territory	Norway
City	Oslo
Period	23/06/08 → 25/06/08

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

More information

10.1007/978-3-540-69295-9_11

Cite this

Wang, Z., Che, H., & Cao, J. (2008). An integrated solution for policy filtering and traffic anomaly detection. In Autonomic and Trusted Computing - 5th International Conference, ATC 2008, Proceedings (pp. 106-120). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 5060 LNCS). https://doi.org/10.1007/978-3-540-69295-9_11

@inproceedings{2794839080dd43aca7ee3941367a1035,

title = "An integrated solution for policy filtering and traffic anomaly detection",

abstract = "In this paper, we propose a Ternary Content Addressable Memory (TCAM) coprocessor based solution for high speed, integrated policy filtering and TCP flow anomaly detection. In the proposed solution, the TCP flow anomaly is detected through two dimensional (2D) matching. The key features of the solution include: (1) setting flag bits in TCAM action code to support various packet treatments; (2) managing TCP flow state in pair to do 2D matching. The solution's ability for detecting TCP-based flooding attacks based on real-world-trace simulations are conducted. The results show that the proposed solution can match up OC-192 line rate while doing the integrated tasks.",

author = "Zhijun Wang and Hao Che and Jiannong Cao",

year = "2008",

month = aug,

day = "4",

doi = "10.1007/978-3-540-69295-9_11",

language = "English",

isbn = "3540692940",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

pages = "106--120",

booktitle = "Autonomic and Trusted Computing - 5th International Conference, ATC 2008, Proceedings",

note = "5th International Conference on Autonomic and Trusted Computing, ATC 2008 ; Conference date: 23-06-2008 Through 25-06-2008",

}

Wang, Z, Che, H & Cao, J 2008, An integrated solution for policy filtering and traffic anomaly detection. in Autonomic and Trusted Computing - 5th International Conference, ATC 2008, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 5060 LNCS, pp. 106-120, 5th International Conference on Autonomic and Trusted Computing, ATC 2008, Oslo, Norway, 23/06/08. https://doi.org/10.1007/978-3-540-69295-9_11

An integrated solution for policy filtering and traffic anomaly detection. / Wang, Zhijun; Che, Hao; Cao, Jiannong.
Autonomic and Trusted Computing - 5th International Conference, ATC 2008, Proceedings. 2008. p. 106-120 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 5060 LNCS).

Research output: Chapter in book / Conference proceeding › Conference article published in proceeding or book › Academic research › peer-review

TY - GEN

T1 - An integrated solution for policy filtering and traffic anomaly detection

AU - Wang, Zhijun

AU - Che, Hao

AU - Cao, Jiannong

PY - 2008/8/4

Y1 - 2008/8/4

N2 - In this paper, we propose a Ternary Content Addressable Memory (TCAM) coprocessor based solution for high speed, integrated policy filtering and TCP flow anomaly detection. In the proposed solution, the TCP flow anomaly is detected through two dimensional (2D) matching. The key features of the solution include: (1) setting flag bits in TCAM action code to support various packet treatments; (2) managing TCP flow state in pair to do 2D matching. The solution's ability for detecting TCP-based flooding attacks based on real-world-trace simulations are conducted. The results show that the proposed solution can match up OC-192 line rate while doing the integrated tasks.

AB - In this paper, we propose a Ternary Content Addressable Memory (TCAM) coprocessor based solution for high speed, integrated policy filtering and TCP flow anomaly detection. In the proposed solution, the TCP flow anomaly is detected through two dimensional (2D) matching. The key features of the solution include: (1) setting flag bits in TCAM action code to support various packet treatments; (2) managing TCP flow state in pair to do 2D matching. The solution's ability for detecting TCP-based flooding attacks based on real-world-trace simulations are conducted. The results show that the proposed solution can match up OC-192 line rate while doing the integrated tasks.

UR - http://www.scopus.com/inward/record.url?scp=48249136540&partnerID=8YFLogxK

U2 - 10.1007/978-3-540-69295-9_11

DO - 10.1007/978-3-540-69295-9_11

M3 - Conference article published in proceeding or book

SN - 3540692940

SN - 9783540692942

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 106

EP - 120

BT - Autonomic and Trusted Computing - 5th International Conference, ATC 2008, Proceedings

T2 - 5th International Conference on Autonomic and Trusted Computing, ATC 2008

Y2 - 23 June 2008 through 25 June 2008

ER -

Wang Z, Che H, Cao J. An integrated solution for policy filtering and traffic anomaly detection. In Autonomic and Trusted Computing - 5th International Conference, ATC 2008, Proceedings. 2008. p. 106-120. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-540-69295-9_11

An integrated solution for policy filtering and traffic anomaly detection

Abstract

Publication series

Conference

ASJC Scopus subject areas

More information

Other files and links

Fingerprint

Cite this