Network monitoring using MMT: an application based on the user-agent field in HTTP headers - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2016

Network monitoring using MMT: an application based on the user-agent field in HTTP headers

Résumé

Despite recent emerging development in intrusion detection or network monitoring, malicious attacks and misbehavior remain a high-risk issue within network traffic. In this paper, we present a proactive solution called MMT (Montimage1 Monitoring Tool) that allows facilitating network security and performance monitoring and operation troubleshooting. We demonstrate the improvements of MMT in comparison with other similar tools. Especially, we assess MMT to deal with a practical case-study in which we analyze the User-Agent field in HTTP headers to determine abnormal activities. Indeed, novel observations figure out the usefulness of the User-Agent field in HTTP requests as a good source to facilitate abnormal activities detection within an abundant traffic. There are eventually several researches alarming the vulnerabilities of the User-Agent field and proposing some manual solution including a combination of tools. However, existing countermeasures are rather passive and do not allow real-time detection. In the context of our research, MMT provides an automated detection of malicious traffic abusing vulnerable User-Agent field. Analyzing abnormal User-Agent strings is also useful to rapidly detect existing evil objects in the network (e.g., bots). The experimental results confirm the improvements of our implementation in comparison with other intrusion detection system (SNORT) and packet analyzing tool (TCPdump)
Fichier non déposé

Dates et versions

hal-01335530 , version 1 (22-06-2016)

Identifiants

Citer

Vinh Hoa La, Raul Armando Fuentes Samaniego, Ana Rosa Cavalli. Network monitoring using MMT: an application based on the user-agent field in HTTP headers. AINA 2016 : 30th International Conference on Advanced Information Networking and Applications, Mar 2016, Crans-Montana, Switzerland. pp.147 - 154, ⟨10.1109/AINA.2016.41⟩. ⟨hal-01335530⟩
100 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More