The Experts below are selected from a list of 1656 Experts worldwide ranked by ideXlab platform

Takuho Mitsunaga - One of the best experts on this subject based on the ideXlab platform.

  • Detecting Abuse of Domain Administrator Privilege Using Windows Event Log
    2018 IEEE Conference on Application Information and Network Security (AINS), 2018
    Co-Authors: Mariko Fujimoto, Wataru Matsuda, Takuho Mitsunaga
    Abstract:

    In an Advanced persistent threat(APT) attack, attackers that infiltrate into an organization network tend to stay inside the network until they are able to accomplish their final goal that may include exploiting sensitive information. When Active Directory is in place, attackers try to obtain a Domain Administrator account which has a privilege to control all users and files in the AD environment. There are several methods for attackers to abuse a legitimate Domain Administrator account. One is to exploit vulnerabilities on Active Directory such as CVE-2014-0317. The other is to steal credentials with password dump tools such as mimikatz. Moreover, attackers are likely to create a backdoor that disguises itself as a legitimate Domain Administrator account called a “Golden Ticket”, in order to obtain long-term administrative privilege. If an attacker abuses a legitimate Domain Administrator account, it is not easy to differentiate a legitimate access and an malicious access. In order to overcome this difficulty, several methods have already been proposed for detecting attacks against AD by analyzing Windows event logs. Each detection method is useful under specific conditions, however none of them cover the entire scope of multiple attacking methods. In this research, we clarify and evaluate the effectiveness of existing methods using a dataset, and propose a new detection algorithm with improved detection rate.

  • Detecting APT Attacks Against Active Directory Using Machine Leaning
    2018 IEEE Conference on Application Information and Network Security (AINS), 2018
    Co-Authors: Wataru Matsuda, Mariko Fujimoto, Takuho Mitsunaga
    Abstract:

    In Advanced Persistent Threat (APT) attacks, attackers who can intrude into an organization network tend to stay inside the network or repeat intrusion multiple times until they are able to accomplish their goals. When Active Directory(AD), a centralization management system for Windows computers, is in place, attackers try to disguise themselves as users of legitimate Domain Administrator accounts, which is the highest privileged account of the AD environment. Activities on the Windows system are recorded in the built-in Windows activity logging system called the Event logs and is commonly used for investigation of attacks. However, if attackers leverage legitimate accounts or built-in Windows tools in order to avoid detection, it is quite difficult to detect attacks from Event logs since attackers' activities are recorded as activities of legitimate Administrator accounts. Although there are various antivirus software, detecting such a sophisticated attack is often very difficult. In this research, we focus on processing attack activity data recorded in the Event logs, and propose a new method based on outlier detection and machine learning for detecting attacks that utilize legitimate accounts. We achieved a high precision rate even if legitimate Domain Administrator accounts are leveraged in attacks.

Marco Mellia - One of the best experts on this subject based on the ideXlab platform.

  • A framework for admission control and path allocation in DiffServ networks
    Computer Networks, 2007
    Co-Authors: M. Ajmone Marsan, G. Mardente, Claudio Casetti, Marco Mellia
    Abstract:

    We consider a Differentiated Service Domain, in which the Domain Administrator has to decide if to accept or to reject Bandwidth Reservation Requests (BRRs) requested by users. We first define an analytical approach and a methodology to determine the set of SLAs that can be effectively supported by a DiffServ IP network. We consider the Assured Forwarding Per Hop Behavior, and, based on the BRR probabilistic description, we derive a worst-case mathematical formulation for the overbooking probability, i.e., the probability that the traffic crossing any link of a source-destination path exceeds the link capacity. Next, we focus our attention to the problem of routing traffic arising from BRRs, i.e., the selection of paths along which traffic may flow. In particular, we show that the construction of an optimal set of paths is equivalent to the construction of a multicast tree, or a Steiner Tree, which is know to be an NP-hard problem. We therefore propose a class of simple heuristics, whose performance are assessed by simulations. Results show the effectiveness of the admission control criterium proposed, and that it is possible to increase up to 40% the amount of capacity a network provider can reserve to BRRs without violating the QoS constraints or to reduce the BRR blocking probability by a order of magnitude by using the proposed optimization algorithm.

  • Admission control and path allocation for SLAs in DiffServ networks
    2004 Workshop on High Performance Switching and Routing 2004. HPSR., 1
    Co-Authors: G. Mardente, Marco Mellia, Claudio Casetti
    Abstract:

    In this paper we consider a Differentiated Service Domain, in which the Domain Administrator has to decide whether to accept or to reject service level agreements (SLA) requested by users. After introducing the admission criteria which are used to verify if there are enough resources to satisfy the SLA request, we focus our attention to the problem of the SLA routing, i.e., the selection of paths along which traffic may flow. In particular, we show that the construction of an optimal set of paths is equivalent to the construction of a multicast tree, or a Steiner tree which is known to be an NP-hard problem. We therefore propose a class of simple heuristics, whose performance is assessed by simulations. Results show that it is possible to increase up to 40% the amount of capacity a network provider can reserve to SLA requests without violating the QoS constraints or to reduce the SLA blocking probability by a order of magnitude by using the proposed algorithms.

Mariko Fujimoto - One of the best experts on this subject based on the ideXlab platform.

  • Detecting Abuse of Domain Administrator Privilege Using Windows Event Log
    2018 IEEE Conference on Application Information and Network Security (AINS), 2018
    Co-Authors: Mariko Fujimoto, Wataru Matsuda, Takuho Mitsunaga
    Abstract:

    In an Advanced persistent threat(APT) attack, attackers that infiltrate into an organization network tend to stay inside the network until they are able to accomplish their final goal that may include exploiting sensitive information. When Active Directory is in place, attackers try to obtain a Domain Administrator account which has a privilege to control all users and files in the AD environment. There are several methods for attackers to abuse a legitimate Domain Administrator account. One is to exploit vulnerabilities on Active Directory such as CVE-2014-0317. The other is to steal credentials with password dump tools such as mimikatz. Moreover, attackers are likely to create a backdoor that disguises itself as a legitimate Domain Administrator account called a “Golden Ticket”, in order to obtain long-term administrative privilege. If an attacker abuses a legitimate Domain Administrator account, it is not easy to differentiate a legitimate access and an malicious access. In order to overcome this difficulty, several methods have already been proposed for detecting attacks against AD by analyzing Windows event logs. Each detection method is useful under specific conditions, however none of them cover the entire scope of multiple attacking methods. In this research, we clarify and evaluate the effectiveness of existing methods using a dataset, and propose a new detection algorithm with improved detection rate.

  • Detecting APT Attacks Against Active Directory Using Machine Leaning
    2018 IEEE Conference on Application Information and Network Security (AINS), 2018
    Co-Authors: Wataru Matsuda, Mariko Fujimoto, Takuho Mitsunaga
    Abstract:

    In Advanced Persistent Threat (APT) attacks, attackers who can intrude into an organization network tend to stay inside the network or repeat intrusion multiple times until they are able to accomplish their goals. When Active Directory(AD), a centralization management system for Windows computers, is in place, attackers try to disguise themselves as users of legitimate Domain Administrator accounts, which is the highest privileged account of the AD environment. Activities on the Windows system are recorded in the built-in Windows activity logging system called the Event logs and is commonly used for investigation of attacks. However, if attackers leverage legitimate accounts or built-in Windows tools in order to avoid detection, it is quite difficult to detect attacks from Event logs since attackers' activities are recorded as activities of legitimate Administrator accounts. Although there are various antivirus software, detecting such a sophisticated attack is often very difficult. In this research, we focus on processing attack activity data recorded in the Event logs, and propose a new method based on outlier detection and machine learning for detecting attacks that utilize legitimate accounts. We achieved a high precision rate even if legitimate Domain Administrator accounts are leveraged in attacks.

Claudio Casetti - One of the best experts on this subject based on the ideXlab platform.

  • A framework for admission control and path allocation in DiffServ networks
    Computer Networks, 2007
    Co-Authors: M. Ajmone Marsan, G. Mardente, Claudio Casetti, Marco Mellia
    Abstract:

    We consider a Differentiated Service Domain, in which the Domain Administrator has to decide if to accept or to reject Bandwidth Reservation Requests (BRRs) requested by users. We first define an analytical approach and a methodology to determine the set of SLAs that can be effectively supported by a DiffServ IP network. We consider the Assured Forwarding Per Hop Behavior, and, based on the BRR probabilistic description, we derive a worst-case mathematical formulation for the overbooking probability, i.e., the probability that the traffic crossing any link of a source-destination path exceeds the link capacity. Next, we focus our attention to the problem of routing traffic arising from BRRs, i.e., the selection of paths along which traffic may flow. In particular, we show that the construction of an optimal set of paths is equivalent to the construction of a multicast tree, or a Steiner Tree, which is know to be an NP-hard problem. We therefore propose a class of simple heuristics, whose performance are assessed by simulations. Results show the effectiveness of the admission control criterium proposed, and that it is possible to increase up to 40% the amount of capacity a network provider can reserve to BRRs without violating the QoS constraints or to reduce the BRR blocking probability by a order of magnitude by using the proposed optimization algorithm.

  • Admission control and path allocation for SLAs in DiffServ networks
    2004 Workshop on High Performance Switching and Routing 2004. HPSR., 1
    Co-Authors: G. Mardente, Marco Mellia, Claudio Casetti
    Abstract:

    In this paper we consider a Differentiated Service Domain, in which the Domain Administrator has to decide whether to accept or to reject service level agreements (SLA) requested by users. After introducing the admission criteria which are used to verify if there are enough resources to satisfy the SLA request, we focus our attention to the problem of the SLA routing, i.e., the selection of paths along which traffic may flow. In particular, we show that the construction of an optimal set of paths is equivalent to the construction of a multicast tree, or a Steiner tree which is known to be an NP-hard problem. We therefore propose a class of simple heuristics, whose performance is assessed by simulations. Results show that it is possible to increase up to 40% the amount of capacity a network provider can reserve to SLA requests without violating the QoS constraints or to reduce the SLA blocking probability by a order of magnitude by using the proposed algorithms.

Wataru Matsuda - One of the best experts on this subject based on the ideXlab platform.

  • Detecting Abuse of Domain Administrator Privilege Using Windows Event Log
    2018 IEEE Conference on Application Information and Network Security (AINS), 2018
    Co-Authors: Mariko Fujimoto, Wataru Matsuda, Takuho Mitsunaga
    Abstract:

    In an Advanced persistent threat(APT) attack, attackers that infiltrate into an organization network tend to stay inside the network until they are able to accomplish their final goal that may include exploiting sensitive information. When Active Directory is in place, attackers try to obtain a Domain Administrator account which has a privilege to control all users and files in the AD environment. There are several methods for attackers to abuse a legitimate Domain Administrator account. One is to exploit vulnerabilities on Active Directory such as CVE-2014-0317. The other is to steal credentials with password dump tools such as mimikatz. Moreover, attackers are likely to create a backdoor that disguises itself as a legitimate Domain Administrator account called a “Golden Ticket”, in order to obtain long-term administrative privilege. If an attacker abuses a legitimate Domain Administrator account, it is not easy to differentiate a legitimate access and an malicious access. In order to overcome this difficulty, several methods have already been proposed for detecting attacks against AD by analyzing Windows event logs. Each detection method is useful under specific conditions, however none of them cover the entire scope of multiple attacking methods. In this research, we clarify and evaluate the effectiveness of existing methods using a dataset, and propose a new detection algorithm with improved detection rate.

  • Detecting APT Attacks Against Active Directory Using Machine Leaning
    2018 IEEE Conference on Application Information and Network Security (AINS), 2018
    Co-Authors: Wataru Matsuda, Mariko Fujimoto, Takuho Mitsunaga
    Abstract:

    In Advanced Persistent Threat (APT) attacks, attackers who can intrude into an organization network tend to stay inside the network or repeat intrusion multiple times until they are able to accomplish their goals. When Active Directory(AD), a centralization management system for Windows computers, is in place, attackers try to disguise themselves as users of legitimate Domain Administrator accounts, which is the highest privileged account of the AD environment. Activities on the Windows system are recorded in the built-in Windows activity logging system called the Event logs and is commonly used for investigation of attacks. However, if attackers leverage legitimate accounts or built-in Windows tools in order to avoid detection, it is quite difficult to detect attacks from Event logs since attackers' activities are recorded as activities of legitimate Administrator accounts. Although there are various antivirus software, detecting such a sophisticated attack is often very difficult. In this research, we focus on processing attack activity data recorded in the Event logs, and propose a new method based on outlier detection and machine learning for detecting attacks that utilize legitimate accounts. We achieved a high precision rate even if legitimate Domain Administrator accounts are leveraged in attacks.