Detection of brute force cache poisoning attacks (cont'd)
{"Image DocumentName": "Detection of brute force cache poisoning attacks (cont\u2019d)", "Image ImageDescription": "If the flow record contains response packets, combine the incoming flow with similar flows by DIP, BPR, DPORT and SIP in the event that the flow arrives within a small time interval (e.g., 1 sec) since the arrival of the last flow in the same thread. Examine if the number of such flows exceeds a threshold (e.g., 50). If the threshold is exceeded, examine all the request threads for the same DIP and see if they have a BPR such that. BPR_{response} > BPR_{request}+BPR_{THR}, where BPR_{THR} the minimum number of additional bytes (set at 16) required to construct a response for a given request Also, examine if the response thread starts within the time limits of the request thread. If all the above conditions are true, summarize the flows and generate an alarm for cache-poisoning attack. If the number of responses in the thread is larger than a threshold, but it is not within the time frame of a request thread or it cannot be matched to a request thread because the BPR condition (see above) is not met, then the algorithm produces an alarm for repeated responses. Empty and restart request and response threads when flows come much later (e.g., more than 1 sec later) or earlier than the last flow in the thread. Periodically (e.g., every 500,000 input flows) clean up threads to free up memory. 4/25/2006. Detection of DNS Traffic Anomalies.", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}