TY - GEN A1 - Vogel, Michael A1 - Schmerl, Sebastian A1 - König, Hartmut T1 - Analyseverlagerung in P2P-Overlaynetzen Y1 - 2009 ER - TY - CHAP A1 - Schmerl, Sebastian A1 - Vogel, Michael A1 - König, Hartmut T1 - Cooperating Intrusion Detection Overlay Structures T2 - 4th GI/ITG KuVS Workshop on Future Internet and 2nd Workshop on Economic Traffic Management (ETM), Zürich, Switzerland, 9 - 10. November 2009 Y1 - 2009 ER - TY - CHAP A1 - Schmerl, Sebastian A1 - Vogel, Michael A1 - König, Hartmut T1 - Identifying Modeling Errors in Signatures by Model Checking. Y1 - 2009 ER - TY - CHAP A1 - Schmerl, Sebastian A1 - Vogel, Michael A1 - Rietz, René A1 - König, Hartmut T1 - Explorative Visualization of Log Data to Support Forensic Analysis and Signature Development T2 - 2010 Fifth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE 2010), Oakland, California, USA, 20 May 2010 Y1 - 2010 SN - 978-1-424-47220-8 SP - 109 EP - 118 PB - IEEE CY - Piscataway, NJ ER - TY - CHAP A1 - Rietz, René A1 - Vogel, Michael A1 - Schuster, Franka A1 - König, Hartmut ED - Dietrich, Sven T1 - Parallelization of Network Intrusion Detection Systems under Attack Conditions T2 - Detection of Intrusions and Malware, and Vulnerability Assessment, 11th International Conference, DIMVA 2014, Egham, UK, July 10-11, 2014 Y1 - 2014 SN - 978-3-319-08508-1 SP - 172 EP - 191 PB - Springer International Publishing CY - Cham ER - TY - GEN A1 - Cwalinski, Radoslaw A1 - Rietz, René A1 - Vogel, Michael A1 - König, Hartmut T1 - An SDN-based Approach to Protect Communication Between Virtual Machines T2 - IEEE 44th Conference on Local Computer Networks (LCN), October 14-17, 2019, Osnabrück, Germany. Y1 - 2019 UR - https://www.ieeelcn.org/prior/LCN44/index.html SN - 978-1-7281-1028-8 SP - 465 EP - 468 PB - IEEE ER - TY - GEN A1 - Vogel, Michael A1 - Schuster, Franka A1 - Kopp, Fabian Malte A1 - König, Hartmut T1 - Data Volume Reduction for Deep Packet Inspection by Multi-layer Application Determination T2 - 2022 IEEE International Conference on Cyber Security and Resilience (CSR), 27-29 July 2022, Rhodes, Greece N2 - Attack detection in enterprise networks is increasingly faced with large data volumes, in part high data bursts, and heavily fluctuating data flows that often cause arbitrary discarding of data packets in overload situations which can be used by attackers to hide attack activities. Attack detection systems usually configure a comprehensive set of signatures for known vulnerabilities in different operating systems, protocols, and applications. Many of these signatures, however, are not relevant in each context, since certain vulnerabilities have already been eliminated, or the vulnerable applications or operating system versions, respectively, are not installed on the involved systems. In this paper, we present an approach for clustering data flows to assign them to dedicated analysis units that contain only signature sets relevant for the analysis of these flows. We discuss the performance of this clustering and show how it can be used in practice to improve the efficiency of an analysis pipeline. Y1 - 2022 UR - https://ieeexplore.ieee.org/abstract/document/9850293 SN - 978-1-6654-9952-1 SN - 978-1-6654-9953-8 U6 - https://doi.org/10.1109/CSR54599.2022.9850293 PB - IEEE ER -