Proceedings of the 3rd European Conference on Computer Network Defense (Lecture Notes in Electrical Engineering, 30)

Proceedings of the 3rd European Conference on Computer Network Defense compiles revised and extended articles written by prominent researchers participating in the 3 rd European Conference on Computer Network Defense (EC2ND). This volume presents information on intrusion detection and privacy protection. The text offers the latest information on advances in network security and serves as an excellent reference work for researchers and graduate students working in the area of computer network defense. The 3rd European Conference on Computer Network Defense took place in September 2007 at Aldemar Hotel, in Heraklion, Crete, Greece in cooperation with the European Network and Information Security Agency (ENISA). The theme of the conference was the protection of computer networks. The conference drew participants from academia and industry in Europe and beyond to discuss hot topics in applied network and systems security. The conference was a great success, with 6 refereed papers and 6 invited presentations on topics ranging from high assurance networks of virtual machines to signaling vulnerabilities in wiretapping systems. This book contains the refereed as well as refereed papers. We are greatful to the authors and presenters for their contributions, as well as the participants of EC2N’07 for making the conference a success. We are looking forward to a successful EC2ND event in 2008. K. G. Anagnostakis, S. Ioannidis, V. Siris Contents 1 Tales from the Crypt: Fingerprinting Attacks on Encrypted Channels by Way of Retainting ........................................1 Michael Valkering, Asia Slowinska, and Herbert Bos 1 Introduction ......................................................................................... 1 2 Architecture ......................................................................................... 3 2.1 Tracking Issues .............................................................................. 4 2.2 Retainting ...................................................................................... 6 2.2.1 Determining the Tag ............................................................. 6 2.2.2 Identifying the SSL Conversation ........................................ 8 2.3 Interposition Details ...................................................................... 9 3 Signature Generation ........................................................................... 9 3.1 Pattern-Based Signatures ............................................................. 10 3.2 Signatures for Polymorphic Buffer Overflows ............................ 13 4 Filters ................................................................................................. 14 5 Results ............................................................................................... 15 6 Related Work ..................................................................................... 17 7 Conclusions ....................................................................................... 18 References ............................................................................................ 18 2 Towards High Assurance Networks of Virtual Machines...............21 Front Matter....Pages I-XI Tales from the Crypt: Fingerprinting Attacks on Encrypted Channels by Way of Retainting....Pages 1-20 Towards High Assurance Networks of Virtual Machines....Pages 21-34 Intrusion Detection Using Cost-Sensitive Classification....Pages 35-47 A Novel Approach for Anomaly Detection over High-Speed Networks....Pages 49-68 Elastic Block Ciphers in Practice: Constructions and Modes of Encryption....Pages 69-91 Vulnerability Response Decision Assistance....Pages 93-105 Alice, What Did You Do Last Time? Fighting Phishing Using Past Activity Tests....Pages 107-117 QuiGon: The First Tool Against Clone Attack on Internet Relay Chat....Pages 119-129 Defending Against Next Generation Through Network/Endpoint Collaboration and Interaction....Pages 131-141 ISi-LANA – A Secure Basic Architecture for Networks Connected to the Internet....Pages 143-151 Back Matter....Pages 153-160 The European Conference on Computer and Network Defense addresses security from multiple perspectives. This includes research in computer network security, intrusion detection, denial-of-service, privacy protection, and incident response and management.