Abstract
With a vastly different header format, IPv6 introduces new vulnerabilities not possible in IPv4, potentially requiring new detection algorithms. While many attacks specific to IPv6 have proven to be possible and are described in the literature, no detection solutions for these attacks have been proposed. In this study we identify and characterise IPv6-specific attacks that can be detected using flow monitoring. By constructing flow-based signatures, detection can be performed using available technologies such as NetFlow and IPFIX. To validate our approach, we implemented these signatures in a prototype, monitoring two production networks and injecting attacks into the production traffic.
| Original language | English |
|---|---|
| Title of host publication | Security of Networks and Services in an All-Connected World |
| Subtitle of host publication | 11th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2017, Proceedings |
| Editors | Daphne Tuncer, Robert Koch, Rémi Badonne, Burkhard Stiller |
| Place of Publication | Cham |
| Publisher | Springer |
| Pages | 137-142 |
| Number of pages | 6 |
| ISBN (Electronic) | 978-3-319-60774-0 |
| ISBN (Print) | 978-3-319-60773-3 |
| DOIs | |
| Publication status | Published - 2017 |
| Event | 11th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2017 - Zurich, Switzerland Duration: 10 Jul 2017 → 13 Jul 2017 Conference number: 11 |
Publication series
| Name | Lecture Notes in Computer Science |
|---|---|
| Publisher | Springer |
| Volume | 10356 |
| ISSN (Print) | 0302-9743 |
| ISSN (Electronic) | 1611-3349 |
| Name | Lecture Notes in Computer Communication Networks and Telecommunications |
|---|---|
| Publisher | Springer |
Conference
| Conference | 11th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2017 |
|---|---|
| Abbreviated title | AIMS |
| Country | Switzerland |
| City | Zurich |
| Period | 10/07/17 → 13/07/17 |
Fingerprint
Cite this
}
Flow-based detection of IPv6-specific network layer attacks. / Hendriks, Luuk ; Velan, Petr; de O. Schmidt, Ricardo ; de Boer, Pieter-Tjerk ; Pras, Aiko .
Security of Networks and Services in an All-Connected World: 11th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2017, Proceedings. ed. / Daphne Tuncer; Robert Koch; Rémi Badonne; Burkhard Stiller. Cham : Springer, 2017. p. 137-142 (Lecture Notes in Computer Science; Vol. 10356), (Lecture Notes in Computer Communication Networks and Telecommunications).Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review
TY - GEN
T1 - Flow-based detection of IPv6-specific network layer attacks
AU - Hendriks, Luuk
AU - Velan, Petr
AU - de O. Schmidt, Ricardo
AU - de Boer, Pieter-Tjerk
AU - Pras, Aiko
PY - 2017
Y1 - 2017
N2 - With a vastly different header format, IPv6 introduces new vulnerabilities not possible in IPv4, potentially requiring new detection algorithms. While many attacks specific to IPv6 have proven to be possible and are described in the literature, no detection solutions for these attacks have been proposed. In this study we identify and characterise IPv6-specific attacks that can be detected using flow monitoring. By constructing flow-based signatures, detection can be performed using available technologies such as NetFlow and IPFIX. To validate our approach, we implemented these signatures in a prototype, monitoring two production networks and injecting attacks into the production traffic.
AB - With a vastly different header format, IPv6 introduces new vulnerabilities not possible in IPv4, potentially requiring new detection algorithms. While many attacks specific to IPv6 have proven to be possible and are described in the literature, no detection solutions for these attacks have been proposed. In this study we identify and characterise IPv6-specific attacks that can be detected using flow monitoring. By constructing flow-based signatures, detection can be performed using available technologies such as NetFlow and IPFIX. To validate our approach, we implemented these signatures in a prototype, monitoring two production networks and injecting attacks into the production traffic.
UR - http://www.scopus.com/inward/record.url?scp=85025133530&partnerID=8YFLogxK
U2 - 10.1007/978-3-319-60774-0_11
DO - 10.1007/978-3-319-60774-0_11
M3 - Conference contribution
AN - SCOPUS:85025133530
SN - 978-3-319-60773-3
T3 - Lecture Notes in Computer Science
SP - 137
EP - 142
BT - Security of Networks and Services in an All-Connected World
A2 - Tuncer, Daphne
A2 - Koch, Robert
A2 - Badonne, Rémi
A2 - Stiller, Burkhard
PB - Springer
CY - Cham
ER -