Computational Environment for Modeling and Analysing Network Traffic Behaviour Using the Divide and Recombine Framework

Autor/in	Barthur, Ashrith
Titel	Computational Environment for Modeling and Analysing Network Traffic Behaviour Using the Divide and Recombine Framework
Quelle	(2016), (89 Seiten) PDF als Volltext Verfügbarkeit Ph.D. Dissertation, Purdue University
Sprache	englisch
Dokumenttyp	gedruckt; online; Monographie
ISBN	978-1-3696-4084-7
Schlagwörter	Hochschulschrift; Dissertation; Computer Security; Information Security; Data Collection; Internet; Databases; Vandalism; Information Networks + Suchen Sie Ihr Suchwort? Thesis; Dissertations; Academic thesis; Computervirus; Computersicherheit; Data capture; Datensammlung; Datenbank; Informationsnetz
Abstract	There are two essential goals of this research. The first goal is to design and construct a computational environment that is used for studying large and complex datasets in the cybersecurity domain. The second goal is to analyse the Spamhaus blacklist query dataset which includes uncovering the properties of blacklisted hosts and understanding the nature of blacklisted hosts over time.The analytical environment enables deep analysis of very large and complex datasets by exploiting the divide and recombine framework. The capability to analyse data in depth enables one to go beyond just summary statistics in research. This deep analysis is at the highest level of granularity without any compromise on the size of the data. The environment is also, fully capable of processing the raw data into a data structure suited for analysis. Spamhaus is an organisation that identifies malicious hosts on the Internet. Information about malicious hosts are stored in a distributed database by Spamhaus and served through the DNS protocol query-response. Spamhaus and other malicious-host-blacklisting organisations have replaced smaller malicious host databases curated independently by multiple organisations for their internal needs. Spamhaus services are popular due to their free access, exhaustive information, historical information, simple DNS based implementation, and reliability. The malicious host information obtained from these databases are used in the first step of weeding out potentially harmful hosts on the internet. During the course of this research work a detailed packet-level analysis was carried out on the Spamhaus blacklist data. It was observed that the query-responses displayed some peculiar behaviours. These anomalies were studied and modeled, and identified to be showing definite patterns. These patterns are empirical proof of a systemic or statistical phenomenon. [The dissertation citations contained here are published with the permission of ProQuest LLC. Further reproduction is prohibited without permission. Copies of dissertations may be obtained by Telephone (800) 1-800-521-0600. Web page: http://www.proquest.com/en-US/products/dissertations/individuals.shtml.] (As Provided).
Anmerkungen	ProQuest LLC. 789 East Eisenhower Parkway, P.O. Box 1346, Ann Arbor, MI 48106. Tel: 800-521-0600; Web site: http://www.proquest.com/en-US/products/dissertations/individuals.shtml
Erfasst von	ERIC (Education Resources Information Center), Washington, DC
Update	2020/1/01