arXiv.itsnick.co

an independent field guide to 23 million papers from arXiv & OpenAlex — not affiliated with arXiv.org

Author

Christian Doerr

62 papers · 2005–2026

2005: 12006: 32007: 42008: 52009: 12010: 02011: 02012: 22013: 32014: 42015: 12016: 52017: 32018: 22019: 52020: 102021: 52022: 22023: 22024: 32025: 02026: 1
2005peak 10 in 20202026

Frequent co-authors

Papers

showing 1–25 of 62 RSS

OpenNetMon: Network monitoring in OpenFlow Software-Defined Networks

Niels L. M. van Adrichem, Christian Doerr, Fernando Kuipers

Computer Networks and Communications · Research Repository (Delft University of Technology) · · cited 452× · DOI ↗ · more like this ·

We present OpenNetMon, an approach and open-source software implementation to monitor per-flow metrics, especially throughput, delay and packet loss, in OpenFlow networks. Currently, ISPs over-provision capacity in order to meet QoS demands from customers. Software-Defined Networking and OpenFlow allow for better network control and flexibility in the pursuit of operating networks as efficiently as possible. Where OpenFlow provides interfaces to implement fine-grained Traffic Engineering (TE), OpenNetMon provides the monitoring necessary to determine whether end-to-end QoS parameters are actually met and delivers the input for TE approaches to compute appropriate paths. OpenNetMon polls edge switches, i.e. switches with flow end-points attached, at an adaptive rate that increases when flow rates differ between samples and decreases when flows stabilize to minimize the number of queries.…

MultiMAC - an adaptive MAC framework for dynamic radio networking

Christian Doerr, Michael Neufeld, Jeffrey Fifield +3 more

Computer Networks and Communications · · cited 126× · DOI ↗ · more like this ·

Software-defined/cognitive radio has recently made the jump from a purely research driven endeavor to one that is now being driven commercially. Such radios offer the promise of spectrum agility and re-configurability through flexibility at the MAC and physical layers. In the wireless domain, it has been shown that hybrid-MAC layer algorithms can lead to improved overall performance in varying network conditions. A hybrid MAC that uses CSMA in low-contention periods and switches to TDMA in high-contention periods can outperform CSMA or TDMA individually. However, such hybrid systems do not offer the flexibility and cognition required of dynamic spectrum networks. In this paper, we describe MultiMAC, a framework and experimental platform for evaluating algorithms that dynamically reconfigure MAC and physical layer properties. MultiMAC acts as a mediating MAC layer and dynamically…

MOJO

Anmol Sheth, Christian Doerr, Dirk Grunwald +2 more

Computer Networks and Communications · · cited 113× · DOI ↗ · more like this ·

Deployments of wireless LANs consisting of hundreds of 802.11 access points with a large number of users have been reported in enterprises as well as college campuses. However, due to the unreliable nature of wireless links, users frequently encounter degraded performance and lack of coverage. This problem is even worse in unplanned networks, such as the numerous access points deployed by homeowners. Existing approaches that aim to diagnose these problems are inefficient because they troubleshoot at too high a level, and are unable to distinguish among the root causes of degradation. This paper designs, implements, and tests fine-grained detection algorithms that are capable of distinguishing between root causes of wireless anomalies at the depth of the physical layer. An important property that emerges from our system is that diagnostic observations are combined from multiple sources…

Examining Mirai's Battle over the Internet of Things

Harm Griffioen, Christian Doerr

Signal Processing · · cited 83× · DOI ↗ · more like this ·

Using hundreds of thousands of compromised IoT devices, the Mirai botnet emerged in late 2016 as a game changing threat actor, capable of temporarily taking down major Internet service providers and Internet infrastructure. Since then, dozens of variants of IoT-based botnets have sprung up, and in today's Internet distributed denial-of-service attacks from IoT devices have become a major attack vector. This proliferation was significantly driven by the public distribution of the Mirai source code, which other actors used to create their own, customized version of the original Mirai botnet. In this paper we provide a comprehensive view into the ongoing battle over the Internet of Things fought by Mirai and its many siblings. Using 7,500 IoT honeypots, we show that we can use 300,000,000 compromisation attempts from infected IoT devices as well as a design flaw in Mirai's random number…

A different cup of {TI}? The added value of commercial threat intelligence

Xander Bouwman, Harm Griffioen, Jelle Egbers +3 more

Information Systems · Research Repository (Delft University of Technology) · · cited 54× · OpenAlex ↗ · more like this ·

Commercial threat intelligence is thought to provide unmatched coverage on attacker behavior, but it is out of reach for many organizations due to its hefty price tag. This paper presents the first empirical assessment of the services of commercial threat intelligence providers. For two leading vendors, we describe what these services consist of and compare their indicators with each other. There is almost no overlap between them, nor with four large open threat intelligence feeds. Even for 22 specific threat actors – which both vendors claim to track – we find an average overlap of only 2.5% to 4.0% between the indicator feeds. The small number of overlapping indicators show up in the feed of the other vendor with a delay of, on average, a month. These findings raise questions on the coverage and timeliness of paid threat intelligence.<br/><br/>We also conducted 14…

Quantifying the Spectrum of Denial-of-Service Attacks through Internet Backscatter

Norbert Blenn, Vincent Ghiëtte, Christian Doerr

Computer Networks and Communications · · cited 41× · DOI ↗ · more like this ·

Denial of Service (DoS) attacks are a major threat currently observable in computer networks and especially the Internet. In such an attack a malicious party tries to either break a service, running on a server, or exhaust the capacity or bandwidth of the victim to hinder customers to effectively use the service. Recent reports show that the total number of Distributed Denial of Service (DDoS) attacks is steadily growing with "mega-attacks" peaking at hundreds of gigabit/s (Gbps).

Malware Coordination using the Blockchain: An Analysis of the Cerber Ransomware

Stijn Pletinckx, Cyril Trap, Christian Doerr

Signal Processing · · cited 39× · DOI ↗ · more like this ·

In order for malicious software to receive configuration information or commands, malware needs to be able to locate and connect to its owner. As hard-coded addresses are easy to block and thus render the malware installation inoperable, malware writers have turned to dynamically generated addresses. Domain generation algorithms (DGA) generate a list of candidate domain names, each valid for only a short time, at which the malware installation searches for its command & control (C&C) server. As DGAs generate a large list of potential domains - out of which one or a few is actually in use -, they leave a characteristic trace of many failed DNS lookups (NXDomain) in the network, and in result most DGAs can be efficiently detected. In this paper we describe an entirely new principle of domain generation, actively deployed in the Cerber ransomware, which finds and coordinates with its owner…

From Hodl to Heist: Analysis of Cyber Security Threats to Bitcoin Exchanges

Kris Oosthoek, Christian Doerr

Information Systems · · cited 38× · DOI ↗ · more like this ·

Bitcoin is gaining traction as an alternative store of value. Its market capitalization transcends all other cryptocurrencies in the market. But its high monetary value also makes it an attractive target to cyber criminal actors. Hacking campaigns usually target the weakest points in an ecosystem. In Bitcoin, these are currently the exchange platforms. As each exchange breach potentially decreases Bitcoin's market value by billions, it is a threat not only to direct victims, but to everyone owning Bitcoin. Based on an extensive analysis of 36 breaches of Bitcoin exchanges, we show the attack patterns used to exploit Bitcoin exchange platforms using an industry standard for reporting intelligence on cyber security breaches. Based on this we are able to provide an overview of the most common attack vectors, showing that all except three hacks were possible due to relatively lax security.…

Scan, Test, Execute: Adversarial Tactics in Amplification DDoS Attacks

Harm Griffioen, Kris Oosthoek, Paul van der Knaap +1 more

Computer Networks and Communications · Research Repository (Delft University of Technology) · · cited 35× · DOI ↗ · more like this ·

Amplification attacks generate an enormous flood of unwanted traffic towards a victim and are generated with the help of open, unsecured services, to which an adversary sends spoofed service requests that trigger large answer volumes to a victim. However, the actual execution of the packet flood is only one of the activities necessary for a successful attack. Adversaries need, for example, to develop attack tools, select open services to abuse, test them, and adapt the attacks if necessary, each of which can be implemented in myriad ways. Thus, to understand the entire ecosystem and how adversaries work, we need to look at the entire chain of activities.

Cyber Security Threats to Bitcoin Exchanges: Adversary Exploitation and Laundering Techniques

Kris Oosthoek, Christian Doerr

Information Systems · IEEE Transactions on Network and Service Management · · cited 34× · DOI ↗ · more like this ·

Bitcoin is gaining traction as an alternative store of value. Its market capitalization transcends all other cryptocurrencies in the market. But its high monetary value also makes it an attractive target to cyber criminal actors. Hacking campaigns usually target an ecosystem’s weakest points. In Bitcoin, the exchange platforms are one of them. Each exchange breach is a threat not only to direct victims, but to the credibility of Bitcoin’s entire ecosystem. Based on an extensive analysis of 36 breaches of Bitcoin exchanges, we show the attack patterns used to exploit Bitcoin exchange platforms using an industry standard for reporting intelligence on cyber security breaches. Based on this we are able to provide an overview of the most common attack vectors, showing that all except three hacks were possible due to relatively lax security. We show that while the security regimen of Bitcoin…

Dynamic Control Channel Assignment in Cognitive Radio Networks Using Swarm Intelligence

Christian Doerr, Douglas Sicker, Dirk Grunwald

Computer Networks and Communications · · cited 28× · DOI ↗ · more like this ·

In recent years, a variety of algorithms for cognitive radio networks have been proposed. Many of these algorithms rely on the exchange of control information among the cognitive radio nodes and often require the presence of a globally available control channel. This requirement however poses a problem in a practical deployment: First, due to spectrum fluctuations such common control channel may be unknown at deployment stage. Second, when designating a fixed, dedicated control channel (for example in licensed spectrum), this will increase costs and expose vulnerability to the operation of the cognitive radio network. Thus, to overcome this difficulty, control channels should be dynamically assigned and managed in cognitive radio networks. In this paper, we propose the use of swarm intelligence as a way to dynamically find and manage such control channels in cognitive radio networks.…

Just the Tip of the Iceberg

H.L.J. Bijmans, Tim Booij, Christian Doerr

Signal Processing · · cited 26× · DOI ↗ · more like this ·

The release of an efficient browser-based cryptominer, as introduced by Coinhive in 2017, has quickly spread throughout the web either as a new source of revenue for websites or exploited within the context of hacks and malicious advertisements. Several studies have analyzed the Alexa Top 1M and found 380 - 3,200 (0.038% - 0.32%) to be actively mining, with an estimated $41,000 per month revenue for the top 10 perpetrators. While placing a cryptominer on a popular website supplies considerable returns from its visitors' web browsers, it only generates revenue while a client is visiting the page. Even though large popular websites attract millions of visitors, the relatively low number of exploiting websites limits the total revenue that can be made. In this paper, we report on a new attack vector that drastically overshadows all existing cryptojacking activity discovered to date.…

The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS Assessments

Raphael Hiesgen, Marcin Nawrocki, Marinho Barcellos +14 more

cs.CR · · cited 24× · arXiv ↗ · more like this ·

Motivated by the impressive but diffuse scope of DDoS research and reporting, we undertake a multistakeholder (joint industry-academic) analysis to seek convergence across the best available macroscopic views of the relative trends in two dominant classes of attacks - direct-path attacks and reflection-amplification attacks. We first analyze 24 industry reports to extract trends and (in)consistencies across observations by commercial stakeholders in 2022. We then analyze ten data sets spanning industry and academic sources, across four years (2019-2023), to find and explain discrepancies based on data sources, vantage points, methods, and parameters. Our method includes a new approach: we share an aggregated list of DDoS targets with industry players who return the results of joining this list with their proprietary data sources to reveal gaps in visibility of the academic data sources.…

All quiet on the internet front?

Christian Doerr, Fernando Kuipers

Computer Networks and Communications · IEEE Communications Magazine · · cited 24× · DOI ↗ · more like this ·

With the proliferation and increasing dependence of many services and applications on the Internet, this network has become a vital societal asset. This creates the need to protect this critical infrastructure, and over the past years a variety of resilience schemes have been proposed. The effectiveness of protection schemes, however, highly depends on the causes and circumstances of Internet failures, but a detailed comprehensive study of this is not yet available to date. This article provides a high-level summary of an evaluation of Internet failures over the past six years, and presents a number of recommendations for future network resilience research.

Have you SYN me? Characterizing Ten Years of Internet Scanning

Harm Griffioen, Georgios Koursiounis, Georgios Smaragdakis +1 more

Computer Networks and Communications · · cited 22× · DOI ↗ · more like this ·

Port scanning is the de-facto method to enumerate active hosts and potentially exploitable services on the Internet. Over the last years, several studies have quantified the ecosystem of port scanning. Each work has found drastic changes in the threat landscape compared to the previous one, and since the advent of high-performance scanning tools and botnets a lot has changed in this highly volatile ecosystem.

Inadvertently Making Cyber Criminals Rich: A Comprehensive Study of Cryptojacking Campaigns at Internet Scale

H.L.J. Bijmans, Tim Booij, Christian Doerr

Signal Processing · Research Repository (Delft University of Technology) · · cited 19× · OpenAlex ↗ · more like this ·

<p>Since the release of a browser-based cryptominer by Coinhive in 2017, the easy use of these miners has skyrocketed illicit cryptomining in 2017 and continued in 2018. This method of monetizing websites attracted website owners, as well as criminals seeking new ways to earn a profit. In this paper, we perform two large studies into the world of cryptojacking, focused on organized cryptomining and the spread of cryptojacking on the Internet. We have identified 204 cryptojacking campaigns, an order of magnitude more than previous work, which indicates that these campaigns are heavily underestimated by previous studies. We discovered that criminals have chosen third-party software - such as WordPress - as their new method for spreading cryptojacking infections efficiently. With a novel method of using NetFlow data we estimated the popularity of mining applications, which showed…

Discovering Collaboration: Unveiling Slow, Distributed Scanners based on Common Header Field Patterns

Harm Griffioen, Christian Doerr

Computer Networks and Communications · · cited 18× · DOI ↗ · more like this ·

To compromise a computer, it is first necessary to discover which hosts are active and which services they run. This reconnaissance is typically accomplished through port scanning. Defense systems monitor for these unsolicited packets and raise an alarm if a predefined threshold is exceeded. To remain undetected, adversaries can either slow down the scan, and/or distribute it over multiple hosts. With each source below the threshold, the combination of all may still complete the scan efficiently. It is especially this group that is of concern: with enough resources and knowledge to execute such a coordinated activity, they will pose a more potent threat than the noisy "script kiddie". Correlating which out of 4 billion IPs potentially collaborate is however a challenging task, hence today’s systems do not consider coordination beyond basic subnet aggregation.In this paper, we propose a…

Context-Sensitive Sentiment Classification of Short Colloquial Text

Norbert Blenn, Kassandra Charalampidou, Christian Doerr

Artificial Intelligence · Lecture notes in computer science · · cited 17× · DOI ↗ · more like this ·

The wide-spread popularity of online social networks and the resulting availability of data to researchers has enabled the investigation of new research questions, such as the analysis of information diffusion and how individuals are influencing opinion formation in groups. Many of these new questions however require an automatic assessment of the sentiment of user statements, a challenging task further aggravated by the unique communication style used in online social networks. This paper compares the sentiment classification performance of current analyzers against a human-tagged reference corpus, identifies the major challenges for sentiment classification in online social applications and describes a novel hybrid system that achieves higher accuracy in this type of environment.

Remote Identification of Port Scan Toolchains

Vincent Ghiëtte, Norbert Blenn, Christian Doerr

Computer Networks and Communications · Data Archiving and Networked Services (DANS) · · cited 16× · DOI ↗ · more like this ·

Port scans are typically at the begin of a chain of events that will lead to the attack and exploitation of a host over a network. Since building an effective defense relies on information what kind of threat an organization is facing, threat intelligence outlining an actor's modus operandi is a critical ingredient for network security. In this paper, we describe characteristic patterns in port scan packets that can be used to identify the tool chain used by an adversary. In an empirical analysis of scan traffic received by two /16 networks, we find that common open source port scan tools are adopted differently by communities across the globe, and that groups specializing to use a particular tool have also specialized to exploit particular services.

Quantifying autonomous system IP churn using attack traffic of botnets

Harm Griffioen, Christian Doerr

Computer Networks and Communications · · cited 13× · DOI ↗ · more like this ·

To connect to the Internet, hosts are assigned an IP address by their network provider by which they exchange data. As such, IP addresses are frequently used as a proxy metric to count the number of hosts on a network, or to quantify particular phenomena such as the size of botnets or the infection statistics of malware. Although a single host is typically linked to a single IP address at a given moment, this relationship is frequently not stable over time due to IP churn. As network operators dynamically assign IP addresses to clients for a specific lease duration, after expiry of this lease a host obtains a new IP address, thereby leading to overestimations of active host counts or malware infections.

Popularity-based Detection of Domain Generation Algorithms

Jasper Abbink, Christian Doerr

Computer Networks and Communications · · cited 13× · DOI ↗ · more like this ·

In order to stay undetected and keep their operations alive, cyber criminals are continuously evolving their methods to stay ahead of current best defense practices. Over the past decade, botnets have developed from using statically hardcoded IP addresses and domain names to randomly-generated ones, so-called domain generation algorithms (DGA). Malicious software coordinated via DGAs leaves however a distinctive signature in network traces of high entropy domain names, and a variety of algorithms have been introduced to detect certain aspects about currently used DGAs.

Local Independent Control of Cognitive Radio Networks

Christian Doerr, Dirk Grunwald, Douglas Sicker

Computer Networks and Communications · · cited 12× · DOI ↗ · more like this ·

Many different algorithms for managing cognitive radio networks have been proposed. While these algorithms have applied the whole range from centrally managed to distributed control schemes, a common feature of previous work is the reliance on explicit communication to exchange and negotiate configuration information. This paper describes a new class of cognitive radio control algorithms employing local independent control based upon swarming behavior found in nature. We examine the feasibility of such local independent control in a testbed implementation of the algorithm, configuring and dynamically adapting a cognitive radio network. We find that approach is suited to coordinate a cognitive radio network based on passive observation of its environment only and may coordinate with other control algorithms deployed in heterogeneous secondary user networks.

Fingerprinting tooling used for SSH compromisation attempts

Vincent Ghiëtte, Harm Griffioen, Christian Doerr

Computer Networks and Communications · Data Archiving and Networked Services (DANS) · · cited 11× · OpenAlex ↗ · more like this ·

<p>In SSH brute forcing attacks, adversaries try a lot of different username and password combinations in order to compromise a system. As such activities are easily recognizable in log files, sophisticated adversaries distribute brute forcing attacks over a large number of origins. Effectively finding such distributed campaigns proves however to be a difficult problem. In practice, when adversaries would spread out brute-forcing over multiple sources, they would likely reuse the same kind of software across all of these origins to simplify their operation and reduce cost. This means if we are able to identify the tooling used in these attempts, we could cluster similar tool usage into likely collaborating hosts and thus campaigns. In this paper, we demonstrate that it is possible to utilize cipher suites and SSH version strings to generate a unique fingerprint for a brute-forcing…

What a Cognitive Radio Network Could Learn From a School of Fish

Christian Doerr, Douglas Sicker, Dirk Grunwald

Computer Networks and Communications · · cited 10× · OpenAlex ↗ · more like this ·

In recent years, various types of control algorithms have been proposed for cognitive radios (CR), ranging from al-gorithms coordinated by centralized control to ones coordi-nated in a distributed manner. These algorithms, however, all require communication to either peer nodes or a master node, thus creating communication overhead and potential vulnerability. We introduce a new class of control algorithms to the area of CRs derived from observations of emergent design in nature. Specifically, we introduce an algorithmic approach based on swarm behavior to the task of config-uration management in CR networks. Without requiring the exchange of information among peers or a central au-thority, CRs equipped with such an algorithm are able to globally optimize the configuration of a CR network in the presence of interference and jammers, while only relying on local information, thus…