SIEGE : Service-Independent Enterprise-GradE protection against password scans

Waldvogel, Marcel; Kollek, Jürgen

SIEGE : Service-Independent Enterprise-GradE protection against password scans

Dateien

Waldvogel_261136.pdfGröße: 471.08 KBDownloads: 372

Datum

2014

Projekt

Secure Networking and Storage

Sammlungen

Informatik und Informationswissenschaft
Rechenzentrum

Publikationstyp

Working Paper/Technical Report

Publikationsstatus

Published

Zusammenfassung

Security is one of the main challenges today, complicated significantly by the heterogeneous and open academic networks with thousands of different applications. Botnet-based brute-force password scans are common security threat against the open academic networks. Common defenses are hard to maintain, error-prone and do not reliably discriminate between user error and coordinated attack. In this paper, we present a novel approach, which allows to secure many network services at once. By combining in-app tracking, local and global crowdsourcing, geographic information, and probabilistic user-bot distinction through differential password analysis, our PAM-based detection module can provide higher accuracy and faster blocking of botnets. In the future, we aim to make the mechanism even more generic and thus provide a distributed defense against one of the strongest threats against our infrastructure.

Fachgebiet (DDC)

004 Informatik

Schlagwörter

Password scan

Zitieren

ISO 690

WALDVOGEL, Marcel, Jürgen KOLLEK, 2014. SIEGE : Service-Independent Enterprise-GradE protection against password scans

BibTex

@techreport{Waldvogel2014SIEGE-26113,
  year={2014},
  title={SIEGE : Service-Independent Enterprise-GradE protection against password scans},
  author={Waldvogel, Marcel and Kollek, Jürgen}
}

RDF

<rdf:RDF
    xmlns:dcterms="http://purl.org/dc/terms/"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
    xmlns:bibo="http://purl.org/ontology/bibo/"
    xmlns:dspace="http://digital-repositories.org/ontologies/dspace/0.1.0#"
    xmlns:foaf="http://xmlns.com/foaf/0.1/"
    xmlns:void="http://rdfs.org/ns/void#"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema#" > 
  <rdf:Description rdf:about="https://kops.uni-konstanz.de/server/rdf/resource/123456789/26113">
    <dcterms:title>SIEGE : Service-Independent Enterprise-GradE protection against password scans</dcterms:title>
    <dcterms:rights rdf:resource="https://rightsstatements.org/page/InC/1.0/"/>
    <dc:language>eng</dc:language>
    <dcterms:isPartOf rdf:resource="https://kops.uni-konstanz.de/server/rdf/resource/123456789/36"/>
    <void:sparqlEndpoint rdf:resource="http://localhost/fuseki/dspace/sparql"/>
    <dcterms:hasPart rdf:resource="https://kops.uni-konstanz.de/bitstream/123456789/26113/1/Waldvogel_261136.pdf"/>
    <dc:date rdf:datatype="http://www.w3.org/2001/XMLSchema#dateTime">2014-02-03T09:16:10Z</dc:date>
    <dspace:hasBitstream rdf:resource="https://kops.uni-konstanz.de/bitstream/123456789/26113/1/Waldvogel_261136.pdf"/>
    <bibo:uri rdf:resource="http://kops.uni-konstanz.de/handle/123456789/26113"/>
    <dc:contributor>Waldvogel, Marcel</dc:contributor>
    <dc:creator>Waldvogel, Marcel</dc:creator>
    <foaf:homepage rdf:resource="http://localhost:8080/"/>
    <dcterms:issued>2014</dcterms:issued>
    <dc:creator>Kollek, Jürgen</dc:creator>
    <dspace:isPartOfCollection rdf:resource="https://kops.uni-konstanz.de/server/rdf/resource/123456789/49"/>
    <dspace:isPartOfCollection rdf:resource="https://kops.uni-konstanz.de/server/rdf/resource/123456789/36"/>
    <dcterms:available rdf:datatype="http://www.w3.org/2001/XMLSchema#dateTime">2014-02-03T09:16:10Z</dcterms:available>
    <dc:contributor>Kollek, Jürgen</dc:contributor>
    <dc:rights>terms-of-use</dc:rights>
    <dcterms:abstract xml:lang="eng">Security is one of the main challenges today, complicated significantly by the heterogeneous and open academic networks with thousands of different applications. Botnet-based brute-force password scans are common security threat against the open academic networks. Common defenses are hard to maintain, error-prone and do not reliably discriminate between user error and coordinated attack. In this paper, we present a novel approach, which allows to secure many network services at once. By combining in-app tracking, local and global crowdsourcing, geographic information, and probabilistic user-bot distinction through differential password analysis, our PAM-based detection module can provide higher accuracy and faster blocking of botnets. In the future, we aim to make the mechanism even more generic and thus provide a distributed defense against one of the strongest threats against our infrastructure.</dcterms:abstract>
    <dcterms:isPartOf rdf:resource="https://kops.uni-konstanz.de/server/rdf/resource/123456789/49"/>
  </rdf:Description>
</rdf:RDF>

Universitätsbibliographie

Ja