Abstract
We propose a model for using firewall log entries of denied inbound Internet traffic for indirect discovery of local IP addresses that have security problems. This method is used successfully to discover two computers on the network of Southern Illinois University which were infected with malicious feral software, as well as two more IP addresses on the university network with other security problems.
Recommended Citation
Langin, Chet, Zhou, Hongbo and Rahimi, Shahram. "A Model to Use Denied Internet Traffic to Indirectly Discover Internal Network Security Problems." (Dec 2008).
COinS
Comments
Published in Langin, C., Zhou, H., & Rahimi, S. (2008). A model to use denied Internet traffic to indirectly discover internal network security problems. IEEE International Performance, Computing and Communications Conference, 2008. IPCCC 2008, 486-490. doi: 10.1109/PCCC.2008.4745091 ©2008 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author's copyright. In most cases, these works may not be reposted without the explicit permission of the copyright holder.