Workshop and poster

FAN: FAst Netflows analyser

Andrea Cosentino, Angelo Spognardi, Antonio Villani, Domenico Vitali and Luigi V. Mancini

The 32nd IEEE International Conference on Computer Communications (INFOCOM2013), Turin, Italy

Abstract Cisco NetFlow protocol is a valid alternative to Deep Packet Inspection (DPI) for network monitoring, since it provides a lightweight picture of exchanged trafﬁc, avoiding the burden of payload access, like privacy concerns and high resource demand. The NetFlow protocol is able to condensate in a single record (called netﬂow) a unidirectional sequence of packets that share the source-destination addresses and that have the same ports, IP protocol, ingress interface, and IP type of service. Actually, NetFlow can be used for many applications, including Intrusion Detection Systems, DoS and anomaly detection and more.

This is why we propose FAN, an open-source, general-purpose and lightweight framework for fast netﬂows analysis. FAN is written in C and can run any kind of plugins for slotted netﬂow analysis. It has a plugin manager able to customize the plugin dependencies, in order to optimise the computations during the analysis. Moreover, it pays a particular attention to netﬂow timeout management, that is a critical aspect of the Netﬂow technology.

Obsidian: A Scalable and Efficient Framework for NetFlow Obfuscation

Antonio Villani, Domenico Vitali, Daniele Riboni, Claudio Bettini and Luigi V. Mancini

The 32nd IEEE International Conference on Computer Communications (INFOCOM2013), Turin, Italy

Abstract The availability of real-world network traces is a fundamental requirement for networking research. Indeed, real network traces can help to effectively model the network behavior, to identify security attacks, and to validate research results. Unfortunately, network flows are extremely sensitive information; as a consequence, security and privacy concerns discourage the publication of such datasets.

In our previous research, we presented (k,j)-obfuscation: a new obfuscation technique for network flows,

that provides formal confidentiality guarantees under realistic assumptions about the adversary’s knowledge, while

preserving the utility of released data. This extended abstract briefly introduces Obsidian, a scalable and efficient

Python implementation of the extended version of the (k,j)-obfuscation technique. Obsidian improves the previous version by supporting the incremental obfuscation of network flows.

This extension enables the obfuscation of larger dataset of network flows as required by networking researcg. As such it has been evaluated with billions of flows generated by the border router of a commercial Autonomous System (AS).

MhRep: Multi-hop Replication Scheme for Data Survival in Unattended Wireless Sensor Networks

D. Vitali, A. Spognardi, L. V. Mancini and A. Villani,

published at 4th International Workshop on Dependable Network Computing and Mobile Systems (DNCMS 2011) in conjunction with SRDS 2011, Madrid, Spain

Abstract Unattended Wireless Sensors Networks (UWSNs) are emerging Wireless Sensor Networks (WSNs) characterized by periodic absence of trusted entities, like the Sink Collectors. The time periods with no sink attendance, force the network sensors to locally store collected data until the next sink visit. This means that data collection is not performed in real time, but it falls at regular intervals. Such conditions define a different paradigm regarding traditional WSNs and introduce several new security issues, data survival above all.

At the best of our knowledge, only two strategies were proposed to mitigate mobile adversary data deletion attack : encryption protocols (implementing backward and/or forward secrecy) and replication. While encryption protocols can impose an extensive computational effort and experience several security issues (like key exposure), replication schemes seem to capture a renewed interest from researchers, since their power requirement seem

compatible with the constraints of wireless sensors. In this paper we focus on a new replication scheme and compare its performances with some other proposals, previously presented in literature. The schemes share some model assumptions, in terms of network and adversary attack strategy and objectives.