Projekt

HISTORY - HIgh Speed neTwork mOnitoRing and analYsis

The aim of this project is to build an architecture, methods, and tools for distributed network analysis. The HISTORY analysis environment makes it possible to collect information about network traffic and its behavior in distributed high-speed network environments. The employment of standardized protocols (IETF IPFIX, PSAMP, and NSIS) results in an extensible architecture. A main objective is to develop methodologies for handling high amounts of statistics and packet data even with cheap low-end components. Visualization techniques and anonymization methods round off the big picture of a visionary environment for all network monitoring and analyzing challenges. Developed tools will be available under an open source license.

Research Goals and Objectives

Cooperative autonomous entities with distributed functioning
Emergent behavior through adaptive self-organization
Operation in high-speed networks while utilizing standard PC components
Wide application range from accounting and charging up to traffic engineering and intrusion detection
Anonymization techniques for wide applicability

Projektleitung:
PD Dr.-Ing. habil. Falko Dressler

Beteiligte:
Dipl. Inf. Ali Fessi (Tübingen) , Dipl. Inf. Andreas Klenk (Tübingen), Dipl. Inf. Gerhard Münz (Tübingen) , Dipl.-Inf. Isabel Dietrich, Dipl.-Inf. Tobias Limmer, Dipl.-Inf. Christoph Sommer

Stichwörter:
network monitoring; accounting; performance measurements; intrusion detection; anonymization; configuration signaling

Laufzeit: 1.9.2003 - 30.6.2010

Förderer:
EU (European Commission)
BMBF
AUDI AG
BSI

Mitwirkende Institutionen:
Computer Networks and Internet, University of Tübingen (Prof. Dr.-Ing. Georg Carle)

Publikationen

Dressler, Falko ; Jaegers, Wolfgang ; German, Reinhard: Flow-based Worm Detection using Correlated Honeypot Logs. In: n.b. (Hrsg.) : Proc. of 15. GI/ITG Fachtagung Kommunikation in Verteilten Systemen ((KiVS 2007) Bern, Switzerland February, 2007). 2007, S. 181-186.

Kaiser, Jochen ; Vitzthum, Alexander ; Holleczek, Peter ; Dressler, Falko: Automated resolving of security incidents as a key mechanism to fight massive infections of malicious software. In: n.b. (Hrsg.) : Proc. of GI SIDAR International Conference on IT-Incident Management & IT-Forensics ((IMF 2006) Stuttgart, Germany October 2006). Bd. LNI P-97. Berlin : Springer Verlag, 2006, S. 92-103.

Münz, Gerhard ; Antony, Albert ; Dressler, Falko ; Carle, Georg: Using Netconf for Configuring Monitoring Probes. In: n.b. (Hrsg.) : Proc. of 10th IFIP/IEEE Network Operations & Management Symposium ((NOMS 2006) Vancouver, Canada April 2006). 2006, S. -.

Dressler, Falko: Policy-based traffic generation for IP-based networks. In: n.b. (Hrsg.) : Proc. of 25th IEEE Conference on Computer Communications ((IEEE INFOCOM 2006) Barcelona, Spain April 2006). 2006, S. -.

Lampert, Ronny T. ; Sommer, Christoph ; Münz, Gerhard ; Dressler, Falko: Vermont - A Versatile Monitoring Toolkit Using IPFIX/PSAMP. In: n.b. (Hrsg.) : Proc. of IEEE/IST Workshop on Monitoring, Attack Detection and Mitigation ((MonAM 2006) Tübingen, Germany September 2006). 2006, S. 62-65.

Dressler, Falko ; Münz, Gerhard: Flexible Flow Aggregation for Adaptive Network Monitoring. In: n.b. (Hrsg.) : Proc. of 31st IEEE Conference on Local Computer Networks : 1st IEEE LCN Workshop on Network Measurements ((LCN), (WNM 2006) Tampa, Florida, USA November 2006). 2006, S. 702-709.

Haibl, Fabian ; Dressler, Falko: Anonymization of Measurement and Monitoring Data: Requirements and Solutions. In: Praxis der Informationsverarbeitung und Kommunikation (PIK) 29 (4) (2006), S. 208-213
[doi>10.1515/PIKO.2006.208]

Dressler, Falko ; Carle, Georg: HISTORY - High Speed Network Monitoring and Analysis. In: n.b. (Hrsg.) : Proc. of 24th IEEE Conf. on Computer Communications ((IEEE INFOCOM 2005) Miami, FL, USA March 2005). 2005, S. -.

Dressler, Falko: Adaptive network monitoring for self-organizing network security mechanisms. In: n.b. (Hrsg.) : Proc. of IFIP International Conference on Telecommunication Systems, Modeling and Analysis 2005 ((ICTSM2005) Dallas, TX, USA November 2005). 2005, S. 67-75.

Dressler, Falko ; Gerhard Münz ; Georg Carle: CATS - Cooperating Autonomous Detection Systems. In: n.b. (Hrsg.) : 1st IFIP TC6 WG6.6 International Workshop on Autonomic Communication ((WAC 2004) Berlin, Germany Oktober). 2004, S. -.