Passive Remote Source NAT Detection Using Behavior Statistics Derived from NetFlow - Emerging Management Mechanisms for the Future Internet
Conference Papers Year : 2013

Passive Remote Source NAT Detection Using Behavior Statistics Derived from NetFlow

Sebastian Abt
  • Function : Author
  • PersonId : 1004070
Christian Dietz
  • Function : Author
  • PersonId : 1004071
Harald Baier
  • Function : Author
  • PersonId : 1004072
Slobodan Petrović
  • Function : Author
  • PersonId : 1004073

Abstract

Network Address Translation (NAT) is a technique commonly employed in today’s computer networks. NAT allows multiple devices to hide behind a single IP address. From a network management and security point of view, NAT may not be desirable or permitted as it allows rogue and unattended network access. In order to detect rogue NAT devices, we propose a novel passive remote source NAT detection approach based on behavior statistics derived from NetFlow. Our approach utilizes 9 distinct features that can directly be derived from NetFlow records. Furthermore, our approach does not require IP address information, but is capable of operating on anonymous identifiers. Hence, our approach is very privacy friendly. Our approach requires only a 120 seconds sample of NetFlow records to detect NAT traffic within the sample with a lower-bound accuracy of 89.35%. Furthermore, our approach is capable of operating in real-time.
Fichier principal
Vignette du fichier
978-3-642-38998-6_18_Chapter.pdf (2.25 Mo) Télécharger le fichier
Origin Files produced by the author(s)
Loading...

Dates and versions

hal-01489964 , version 1 (14-03-2017)

Licence

Identifiers

Cite

Sebastian Abt, Christian Dietz, Harald Baier, Slobodan Petrović. Passive Remote Source NAT Detection Using Behavior Statistics Derived from NetFlow. 7th International Conference on Autonomous Infrastructure (AIMS), Jun 2013, Barcelona, Spain. pp.148-159, ⟨10.1007/978-3-642-38998-6_18⟩. ⟨hal-01489964⟩
111 View
370 Download

Altmetric

Share

More