How to exchange security events? Overview and evaluation of formats and protocols

Jessica Steinberger, Anna Sperotto, Mario Golling, Harald Baier

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    37 Citations (Scopus)
    373 Downloads (Pure)


    Network-based attacks pose a strong threat to the Internet landscape. %As of today network flow-based information is used as data source for detecting anomalous network traffic because flow data yields an aggregated view on the network and protects the users' privacy. Recent approaches to mitigate and resolve these threats focus on cooperation of Internet service providers and their exchange of security event information. A major benefit of a cooperation is that it might counteract a network-based attack at its root and provides the possibility to inform other cooperative partners about the occurrence of anomalous events as a proactive service. In this paper we provide a structured overview of existing exchange formats and protocols. We evaluate and compare the exchange formats and protocols in context of high-speed networks. In particular, we focuses on flow data. In addition, we investigate the exchange of potentially sensitive data. For our overview, we review different exchange formats and protocols with respect to their use-case scenario, their interoperability with network flow-based data, their scalability in a high-speed network context and develop a classification.
    Original languageUndefined
    Title of host publicationIFIP/IEEE International Symposium on Integrated Network Management (IM 2015)
    Place of PublicationUSA
    PublisherIEEE Computer Society
    Number of pages9
    ISBN (Print)978-3-901882-76-0
    Publication statusPublished - 13 May 2015
    Event14th IFIP/IEEE International Symposium on Integrated Network Management, IM 2015: Integrated Management in the Age of Big Data - Shaw Centre, Ottawa, Canada
    Duration: 11 May 201515 May 2015
    Conference number: 14

    Publication series

    PublisherIEEE Computer Society


    Conference14th IFIP/IEEE International Symposium on Integrated Network Management, IM 2015
    Abbreviated titleIM 2015
    Internet address


    • EWI-25480
    • METIS-312463
    • IR-96794

    Cite this