@conference {18551,
	title = {Boosting the scalability of botnet detection using adaptive traffic sampling},
	booktitle = {Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security},
	series = {ASIACCS {\textquoteright}11},
	year = {2011},
	month = {2011///},
	pages = {124 - 134},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Botnets pose a serious threat to the health of the Internet. Most current network-based botnet detection systems require deep packet inspection (DPI) to detect bots. Because DPI is a computational costly process, such detection systems cannot handle large volumes of traffic typical of large enterprise and ISP networks. In this paper we propose a system that aims to efficiently and effectively identify a small number of suspicious hosts that are likely bots. Their traffic can then be forwarded to DPI-based botnet detection systems for fine-grained inspection and accurate botnet detection. By using a novel adaptive packet sampling algorithm and a scalable spatial-temporal flow correlation approach, our system is able to substantially reduce the volume of network traffic that goes through DPI, thereby boosting the scalability of existing botnet detection systems. We implemented a proof-of-concept version of our system, and evaluated it using real-world legitimate and botnet-related network traces. Our experimental results are very promising and suggest that our approach can enable the deployment of botnet-detection systems in large, high-speed networks.},
	keywords = {adaptive sampling, botnet, intrusion detection, NETWORK SECURITY},
	isbn = {978-1-4503-0564-8},
	doi = {10.1145/1966913.1966930},
	url = {http://doi.acm.org/10.1145/1966913.1966930},
	author = {Zhang,Junjie and Luo,Xiapu and Perdisci,Roberto and Gu,Guofei and Lee,Wenke and Feamster, Nick}
}
@conference {18591,
	title = {Outsourcing home network security},
	booktitle = {Proceedings of the 2010 ACM SIGCOMM workshop on Home networks},
	series = {HomeNets {\textquoteright}10},
	year = {2010},
	month = {2010///},
	pages = {37 - 42},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {The growth of home and small enterprise networks brings with it a large number of devices and networks that are either managed poorly or not at all. Hosts on these networks may become compromised and become sources of spam, denial-of-service traffic, or the site of a scam or phishing attack site. Although a typical user now knows how to apply software updates and run anti-virus software, these techniques still require user vigilance, and they offer no recourse when a machine ultimately becomes compromised. Rather than having individual networks managed independently, we propose to outsource the management and operation of these networks to a third party that has both operations expertise and a broader view of network activity. Our approach harnesses two trends: (1) the advent of programmable network switches, which offer flexibility and the possibility for remote management; and (2) the increasing application of distributed network monitoring and inference algorithms to network security problems (an appealing technique because of its ability to reveal coordinated behavior that may represent an attack).},
	keywords = {home networking, NETWORK SECURITY, programmable networking},
	isbn = {978-1-4503-0198-5},
	doi = {10.1145/1851307.1851317},
	url = {http://doi.acm.org/10.1145/1851307.1851317},
	author = {Feamster, Nick}
}
@conference {18658,
	title = {Analysis of Computer Security Incident Data Using Time Series Models},
	year = {2008},
	month = {2008/11//},
	pages = {77 - 86},
	abstract = {Organizations face increasing challenges in addressing and preventing computer and network security incidents. There are financial consequences from security incidents. These include lost time and resources used during recovery, possible theft of personal and/or proprietary information, and reputational damage that may negatively impact stock prices or reduce consumer confidence in a company. Being able to understand and predict trends in computer and network security incidents can aid an organization with resource allocation for prevention of such incidents, as well as evaluation of mitigation strategies. We look at using time series models with a large set of security incident data. We examine appropriateness of the data for modeling and consider needed transformations. Parameter search and model selection criteria are discussed. Then, forecasts from time series models are compared to forecasts from Non-Homogeneous Poisson Process (NHPP) software reliability growth (SRG) models.},
	keywords = {Computer networks, computer security incident data, NETWORK SECURITY, resource allocation, security of data, telecommunication security, time series, time series model},
	doi = {10.1109/ISSRE.2008.39},
	author = {Condon,E. and He,A. and Michel Cukier}
}
