 |
Emerging Management Mechanisms for the Future Internet 7th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2013 Barcelona, Spain, June 25-28, 2013 |
 |
Conference papers
Passive Remote Source NAT Detection Using Behavior Statistics Derived from NetFlow
Abstract : Network Address Translation (NAT) is a technique commonly employed in today’s computer networks. NAT allows multiple devices to hide behind a single IP address. From a network management and security point of view, NAT may not be desirable or permitted as it allows rogue and unattended network access. In order to detect rogue NAT devices, we propose a novel passive remote source NAT detection approach based on behavior statistics derived from NetFlow. Our approach utilizes 9 distinct features that can directly be derived from NetFlow records. Furthermore, our approach does not require IP address information, but is capable of operating on anonymous identifiers. Hence, our approach is very privacy friendly. Our approach requires only a 120 seconds sample of NetFlow records to detect NAT traffic within the sample with a lower-bound accuracy of 89.35%. Furthermore, our approach is capable of operating in real-time.
Cited literature [22 references]
https://hal.inria.fr/hal-01489964
Contributor : Hal Ifip <>
Submitted on : Tuesday, March 14, 2017 - 5:06:16 PM
Last modification on : Tuesday, March 14, 2017 - 5:12:29 PM
Document(s) archivé(s) le : Thursday, June 15, 2017 - 3:13:59 PM
Contributor : Hal Ifip <>
Submitted on : Tuesday, March 14, 2017 - 5:06:16 PM
Last modification on : Tuesday, March 14, 2017 - 5:12:29 PM
Document(s) archivé(s) le : Thursday, June 15, 2017 - 3:13:59 PM
File
978-3-642-38998-6_18_Chapter.p...
Files produced by the author(s)
Licence
Distributed under a Creative Commons Attribution 4.0 International License
