An Architecture for Scalable Network Defense

Date Added: Aug 2009
Format: PDF

This paper describes a novel architecture for network defense designed for scaling to very high data rates (100 Gb/s) and very large user populations. Scaling requires both efficient attack detection algorithms as well as appropriate an execution environment. The architecture considers the time budget of traffic data extraction and algorithmic processing, provides a suite of detection algorithms - each designed to present different and complementary views of the data - that generate many "Traffic Events," and reduces false positives by correlating these traffic events into benign or malicious hypotheses.