TU Berlin

Main document

Literature Database Entry


Philip Klaus Höhlein, "Signature-based Attack Detection on Flow Data," Bachelor Thesis, Department of Computer Science, Friedrich–Alexander University of Erlangen–Nuremberg (FAU), May 2011. (Advisors: Tobias Limmer and Falko Dressler)


Due to the rising data rates available via so called high-speed Internet connections, the network traffic increased considerably. Unfortunately also the malicious usage of the Internet increased enormously and separately, attack detection mechanisms are essential. Due to the high packet data rates network data inspection becomes much complexer. Therefore it becomes impossible to inspect each network packet and consequently attacks could remain undetected. To get a compact representation of the whole network traffic, network packets can be aggregated into IP Flow Information eXport (IPFIX) flow records In our approach we want to detect attacks by utilizing these aggregated flow records for suspicious signatures. As a reference implementation for creating and processing IPFIX flow records, we will use the open source software Vermont. Our approach tries to detect attacks with help of signature-based rules that are tested on each flow record. Therefore we need to analyze which signatures of a flow record are of interest for intrusion detection and define a syntax for our signature rules. Moreover we will discuss, how to match rules efficiently and approach, present our implementation of a flow signature matcher. It will be developed as a module for Vermont. Moreover we will test the performance of our and compare it with Snort, a state of the art NIDS.

Quick access

BibTeX BibTeX


Philip Klaus Höhlein

BibTeX reference

    author = {H{\"{o}}hlein, Philip Klaus},
    title = {{Signature-based Attack Detection on Flow Data}},
    advisor = {Limmer, Tobias and Dressler, Falko},
    institution = {Department of Computer Science},
    location = {Erlangen, Germany},
    month = {5},
    school = {Friedrich--Alexander University of Erlangen--Nuremberg (FAU)},
    type = {Bachelor Thesis},
    year = {2011},

Copyright notice

Links to final or draft versions of papers are presented here to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author's copyright. In most cases, these works may not be reposted or distributed for commercial purposes without the explicit permission of the copyright holder.

The following applies to all papers listed above that have IEEE copyrights: Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.

The following applies to all papers listed above that are in submission to IEEE conference/workshop proceedings or journals: This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible.

The following applies to all papers listed above that have ACM copyrights: ACM COPYRIGHT NOTICE. Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers, or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from Publications Dept., ACM, Inc., fax +1 (212) 869-0481, or permissions@acm.org.

The following applies to all SpringerLink papers listed above that have Springer Science+Business Media copyrights: The original publication is available at www.springerlink.com.

This page was automatically generated using BibDB and bib2web.