.png){kind=icon}
返回
Packet Chunking for File Detection
.png){kind=icon}
PRE
AI
DOI：10.1109/TNET.2022.3215549.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Network-based intrusion detection and data leakage prevention systems inspect packets to detect if critical files such as malware or confidential documents are transferred. However, this kind of detection requires heavy computing resources in reassembling packets and only well-known protocols can be interpreted. Besides, finding similar files from a storage requires pairwise comparisons. In this paper, we present a new network-based file identification scheme that inspects packets independently without reassembly and finds similar files through inverted indexing instead of pairwise comparison. We use a content-based chunking algorithm to consistently divide both files and packets into multiple byte sequences, called chunks. If a packet is a part of a file, they would have common chunks. The challenging problem is that packet chunking and inverted-index search should be fast and scalable enough for packet processing. The file identification should be accurate although many chunks are noises. In this paper, we use a small Bloom filter and a two-level threshold strategy to solve the problems. To the best of our knowledge, this is the first scheme that identifies a specific critical file from a packet over unknown protocols. Experimental results show that the proposed scheme can successfully identify a critical file from a packet without packet reassembly.
Keyword:
Bloom filter
data leakage prevention
inverted index
cybersecurity
content-based chunking
期刊
I
IF:
3.6
论文数:
4.4K
被引数:
9.5K
机构
引用论文
.png){kind=icon}
分享收藏Detrusor Regeneration in the Rat Using Porcine Small Intestinal Submucosal Grafts使用猪小肠黏膜下层移植物进行大鼠逼尿肌再生
PREAI
分享收藏
查看更多内容