Skip to Main content Skip to Navigation
Conference papers

Passive Remote Source NAT Detection Using Behavior Statistics Derived from NetFlow

Abstract : Network Address Translation (NAT) is a technique commonly employed in today’s computer networks. NAT allows multiple devices to hide behind a single IP address. From a network management and security point of view, NAT may not be desirable or permitted as it allows rogue and unattended network access. In order to detect rogue NAT devices, we propose a novel passive remote source NAT detection approach based on behavior statistics derived from NetFlow. Our approach utilizes 9 distinct features that can directly be derived from NetFlow records. Furthermore, our approach does not require IP address information, but is capable of operating on anonymous identifiers. Hence, our approach is very privacy friendly. Our approach requires only a 120 seconds sample of NetFlow records to detect NAT traffic within the sample with a lower-bound accuracy of 89.35%. Furthermore, our approach is capable of operating in real-time.
Complete list of metadatas

Cited literature [22 references]  Display  Hide  Download

https://hal.inria.fr/hal-01489964
Contributor : Hal Ifip <>
Submitted on : Tuesday, March 14, 2017 - 5:06:16 PM
Last modification on : Tuesday, March 14, 2017 - 5:12:29 PM
Document(s) archivé(s) le : Thursday, June 15, 2017 - 3:13:59 PM

File

978-3-642-38998-6_18_Chapter.p...
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Sebastian Abt, Christian Dietz, Harald Baier, Slobodan Petrović. Passive Remote Source NAT Detection Using Behavior Statistics Derived from NetFlow. 7th International Conference on Autonomous Infrastructure (AIMS), Jun 2013, Barcelona, Spain. pp.148-159, ⟨10.1007/978-3-642-38998-6_18⟩. ⟨hal-01489964⟩

Share

Metrics

Record views

172

Files downloads

458