Forensic Analysis for Epidemic Attacks in
Yinglian Xie, Vyas Sekar, Michael K. Reiter, Hui Zhang · 2006
We present the design of a Network Forensic Alliance (NFA), to allow multiple administrative domains (ADs) to jointly locate the origin of epidemic spreading attacks. ADs in the NFA collaborate in a distributed protocol for post-mortem analysis of worm-like attacks. Information exchange between any two participating ADs is limited to traffic records that are k nown to both sides, maintaining the privacy of participants. Such an architecture is incentive-compatible - participants benefit by gaining better local investigative capabilities, even wit h partial deployment. Further, we show that by sharing local investigation results, ADs can achieve global investigative capabilitie s that are comparable to a centralized implementation with access to global traffic records. Our evaluation demonstrates that it is feas ible for large-scale attack investigation to be incrementally deployed in an Internet-like federation.