TY - CHAP A1 - Kanisch, Heiko A1 - Schuster, Franka A1 - König, Hartmut ED - Rudel, Steffi ED - Lechner, Ulrike T1 - Informationstechnik in der Energieversorgung – Besonderheiten und Regularien T2 - IT-Sicherheit für Kritische Infrastrukturen - State of the Art : Ergebnisse des Förderschwerpunkts IT-Sicherheit für Kritische Infrastrukturen ITS/KRITIS des BMBF Y1 - 2018 SN - 978-3-943207-33-0 SN - 978-3-943207-34-7 SP - 67 EP - 68 PB - Professur für Wirtschaftsinformatik, Universität der Bundeswehr München CY - Neubiberg ET - 1. Auflage ER - TY - GEN A1 - Vogel, Michael A1 - Schuster, Franka A1 - Kopp, Fabian Malte A1 - König, Hartmut T1 - Data Volume Reduction for Deep Packet Inspection by Multi-layer Application Determination T2 - 2022 IEEE International Conference on Cyber Security and Resilience (CSR), 27-29 July 2022, Rhodes, Greece N2 - Attack detection in enterprise networks is increasingly faced with large data volumes, in part high data bursts, and heavily fluctuating data flows that often cause arbitrary discarding of data packets in overload situations which can be used by attackers to hide attack activities. Attack detection systems usually configure a comprehensive set of signatures for known vulnerabilities in different operating systems, protocols, and applications. Many of these signatures, however, are not relevant in each context, since certain vulnerabilities have already been eliminated, or the vulnerable applications or operating system versions, respectively, are not installed on the involved systems. In this paper, we present an approach for clustering data flows to assign them to dedicated analysis units that contain only signature sets relevant for the analysis of these flows. We discuss the performance of this clustering and show how it can be used in practice to improve the efficiency of an analysis pipeline. Y1 - 2022 UR - https://ieeexplore.ieee.org/abstract/document/9850293 SN - 978-1-6654-9952-1 SN - 978-1-6654-9953-8 U6 - https://doi.org/10.1109/CSR54599.2022.9850293 PB - IEEE ER -