Malicious PDF — malware analysis report

0 g
1 i 
/RelativeColorimetric ri
/GS0 gs
BT
/T1_0 1 Tf
0 Tc 0 Tw 0  Ts 100  Tz 0 Tr 8.9664 0 0 8.9664 53.79829 728.23907 Tm
[(the)-245(concepts)-246(of)-245(payload)-246(anomaly)-245(detection,)-246(and)-246(introduces)-245(tw)10(o)-246(de-)]TJ
0 -1.1667 TD
[(tectors)-350(de)25(v)15(eloped)-350(by)-350(our)-349(group\204P)92(A)105(YL)-350(and)-350(Anagram\204as)-350(a)-350(rep-)]TJ
T*
[(resentati)25(v)15(e)-329(class)-330(of)-329(local)-330(detectors.)-548(Section)-329(3)-330(then)-329(introduces)-330(the)]TJ
T*
[(pri)25(v)25(ac)15(y-preserving)-384(correlation)-384(techniques)-384(at)-384(the)-384(heart)-384(of)-384(this)-384(pa-)]TJ
T*
[(per)55(.)-601(Section)-347(4)-347(sho)25(ws)-347(some)-347(early)-347(results)-347(based)-347(on)-347(the)-347(techniques)]TJ
T*
[(described)-223(in)-223(section)-224(3.)-301(W)80(e)-223(discuss)-223(related)-223(w)10(ork)-224(in)-223(section)-223(5,)-229(brie\224y)]TJ
T*
[(look)-250(at)-250(future)-250(possibilities)-250(in)-250(section)-250(6)-250(and)-250(conclude)-250(in)-250(section)-250(7.)]TJ
/T1_1 1 Tf
11.9552 0 0 11.9552 53.79829 636.58777 Tm
[(2.)-1000(P)74(A)100(YLO)40(AD)-250(ANOMAL)92(Y)-250(DETECTION)]TJ
/T1_0 1 Tf
8.9664 0 0 8.9664 62.76469 623.63629 Tm
[(In)-319(order)-320(to)-319(better)-320(moti)25(v)25(ate)-319(the)-320(correlation)-319(techniques)-320(described)]TJ
-1 -1.1667 Td
[(in)-361(this)-361(paper)40(,)-389(we)-361(\223rst)-361(describe)-361(tw)10(o)-361(payload)-361(anomaly)-361(sensors)-361(de-)]TJ
T*
[(v)15(eloped)-387(at)-388(Columbia:)-584(P)92(A)105(YL,)-388(which)-387(implements)-387(anomaly)-388(detec-)]TJ
T*
[(tion)-410(based)-410(on)-410(frequenc)15(y-based)-410(1-gram)-410(modeling,)-450(and)-410(Anagram,)]TJ
T*
[(which)-209(uses)-209(binary-based)-209(mixtures)-209(of)-209(higher)-209(order)-209(n-gram)-209(modeling)]TJ
T*
(\()Tj
/T1_2 1 Tf
0.36099 Tc 0.33299 0 Td
(n>)Tj
/T1_3 1 Tf
0 Tc 2.14079 0 Td
(1)Tj
/T1_0 1 Tf
0.5139 0 Td
[(\).)-429(Both)-289(sensors)-290(train)-289(on)]TJ
/T1_4 1 Tf
9.89149 0 Td
(normal)Tj
/T1_0 1 Tf
3.1795 0 Td
[(unencrypted)-289(content)-290(\224o)25(ws)]TJ
-16.0587 -1.1667 Td
[(and)-328(emplo)10(y)-327(service-speci\223c)-328(models)-328(to)-328(test)-327(for)-328(suspicious)-328(traf)25(\223c.)]TJ
5.9776 0 0 5.9776 289.41479 564.68048 Tm
(1)Tj
8.9664 0 0 8.9664 53.79829 550.41077 Tm
[(Alerts)-302(are)-303(generated)-302(on)-302(traf)25(\223c)-302(suf)25(\223ciently)-303(de)25(viant)-302(from)-302(normal;)-329(it)]TJ
T*
[(is)-246(these)-246(alerts)-245(that)-246(we)-246(wish)-246(to)-246(share)-246(with)-245(other)-246(sites)-246(to)-246(resolv)15(e)-246(f)10(alse)]TJ
T*
[(positi)25(v)15(es)-314(from)-315(true)-315(zero-day)-314(attacks.)-504(The)-314(reader)-315(is)-314(encouraged)-315(to)]TJ
T*
[(refer)-233(to)-234([46,)-236(44,)-237(45])-233(for)-234(detailed)-233(descriptions)-233(of)-233(the)-234(aforementioned)]TJ
T*
(sensors.)Tj
1 -1.1667 Td
[(It)-431(is)-430(also)-431(important)-431(to)-430(note)-431(that)-430(we)-431(do)-431(not)-430(intend)-431(to)-431(address)]TJ
-1 -1.1667 Td
[(all)-314(possible)-314(payload)-314(detection)-314(techniques)-314(here.)-502(Consequently)65(,)-330(the)]TJ
T*
[(techniques)-267(described)-267(in)-267(section)-267(3)-267(may)-267(be)-267(usable)-268(with)-267(other)-267(\(possi-)]TJ
T*
[(bly)-250(host-based)-250(and/or)-250(misuse\))-250(sensors.)]TJ
/T1_1 1 Tf
11.9552 0 0 11.9552 53.79829 445.80548 Tm
[(2.1)-1000(P)74(A)100(YL:)-250(1-gram)-250(fr)18(equency)-250(modeling)]TJ
/T1_0 1 Tf
8.9664 0 0 8.9664 62.76469 432.8541 Tm
[(P)92(A)105(YL)92(\220)55(s)-348(models)-349(are)-348(1-gram)-349(byte)-348(frequenc)15(y)-348(distrib)20(utions)-349(condi-)]TJ
-1 -1.1667 Td
[(tioned)-241(on)-240(pack)10(et)-241(length;)-244(tested)-241(traf)25(\223c)-241(is)-240(classi\223ed)-241(as)-240(normal)-241(or)-241(ma-)]TJ
T*
[(licious)-264(by)-264(computing)-265(the)-264(Mahalanobis)-264(distance)-264(between)-264(the)-265(distri-)]TJ
T*
[(b)20(ution)-272(of)-271(the)-272(candidate)-272(pack)10(ets)-271(and)-272(the)-271(frequenc)15(y)-272(model.)-375(A)-272(lar)18(ger)]TJ
T*
[(distance)-370(means)-369(bigger)-370(de)25(viation)-370(from)-369(the)-370(model)-370(and)-369(a)-370(more)-370(ab-)]TJ
T*
[(normal)-333(pack)10(et;)-374(thresholding)-333(dif)25(ferentiates)-333(normal)-333(from)-333(malicious)]TJ
T*
[(traf)25(\223c.)]TJ
1 -1.1667 Td
(A)Tj
/T1_4 1 Tf
-0.015 Tc 1.1561 0 Td
[(ra)-15(w)]TJ
/T1_0 1 Tf
0 Tc 1.9753 0 Td
[(P)92(A)105(YL)-434(alert)-434(typically)-435(contains)-434(metadata,)-480(including)-434(the)]TJ
-4.1313 -1.1667 Td
[(source)-301(and)-300(tar)18(get)-301(IP/port)-300(pair)40(,)-314(payload)-300(length,)-314(and)-301(score)-301(\(distance)]TJ
T*
[(from)-273(model\).)-381(Additionally)65(,)-279(the)-273(suspicious)-274(pack)10(et)-273(may)-273(be)-274(included)]TJ
T*
[(in)-243(its)-243(alert.)-308(While)-243(the)-243(payloads)-243(can)-244(be)-243(shared,)-244(the)15(y)-244(signi\223cantly)-244(in-)]TJ
T*
[(crease)-203(alert)-204(sizes)-203(and)-204(run)-203(into)-204(pri)25(v)25(ac)15(y)-203(issues,)-213(especially)-203(for)-204(misclas-)]TJ
T*
[(si\223ed)-274(traf)25(\223c,)-281(i.e.)-384(f)10(alse)-274(positi)25(v)15(es.)-384(While)-274(P)92(A)105(YL)92(\220)55(s)-275(f)10(alse)-274(positi)25(v)15(e)-275(rates)]TJ
T*
[(ha)20(v)15(e)-302(been)-301(determined)-302(to)-301(be)-302(v)15(ery)-301(lo)25(w)-302([44],)-314(the)-302(notion)-301(of)-302(transmit-)]TJ
T*
[(ting)-250(an)15(y)-250(ra)15(w)-250(payload)-250(inhibits)-250(collaboration)-250(among)-250(defensi)25(v)15(e)-250(sites.)]TJ
/T1_1 1 Tf
11.9552 0 0 11.9552 53.79829 265.4841 Tm
[(2.2)-1000(Anagram:)-361(n-gram)-250(binary)-250(modeling)]TJ
/T1_0 1 Tf
8.9664 0 0 8.9664 62.76469 252.5327 Tm
[(Anagram)-290(uses)-291(an)-290(alternati)25(v)15(e)-291(approach)-290(to)-291(anomaly)-290(detection)-291(via)]TJ
/T1_4 1 Tf
-1 -1.1667 Td
[(binary-based)-320(high)-321(or)37(der)-320(n-gr)15(am)-321(modeling)]TJ
/T1_0 1 Tf
17.1725 0 Td
[(.)-521(Compared)-321(to)-320(1-gram,)]TJ
-17.1725 -1.1667 Td
[(higher)-291(order)-291(n-grams)-291(are)-291(better)-291(at)-290(modeling)-291(sequential)-291(content)-291(in-)]TJ
T*
[(formation)-395(in)-395(pack)10(ets,)-431(and)-395(thus)-394(it)-395(is)-395(capable)-395(of)-395(detecting)-395(signi\223-)]TJ
T*
[(cant)-283(anomalous)-283(byte)-283(sequences)-282(and)-283(their)-282(location)-283(within)-282(a)-283(pack)10(et.)]TJ
T*
[(T)80(o)-262(a)20(v)20(oid)-263(signi\223cant)-262(memory)-263(o)15(v)15(erhead)-262(associated)-263(with)-262(n-gram)-263(fre-)]TJ
T*
[(quenc)15(y)-207(distrib)20(utions,)-215(only)-207(a)-206(binary)-207(\(yes/no\))-207(statistic)-207(is)-206(k)10(ept)-207(for)-207(each)]TJ
T*
[(possible)-208(gram.)-296(Scoring)-209(is)-208(accomplished)-208(by)-208(counting)-208(the)-209(percentage)]TJ
T*
[(of)-203(not-seen-before)-203(\(i.e.)-294(unusual\))-203(n-grams)-202(out)-203(of)-202(the)-203(total)-202(n-grams)-203(in)]TJ
-0.00011 Tc T*
[(the)-236(pack)10(et,)-239(and)-235(thresholding)-236(is)-236(again)-236(applied)-236(to)-236(dif)25(ferentiate)-236(traf)25(\223c.)]TJ
0 Tc 1 -1.1667 Td
[(Surprisingly)65(,)-202(analysis)-190(sho)25(ws)-190([45])-190(that)-190(binary-based)-190(modeling)-190(pro-)]TJ
-1 -1.1667 Td
[(duces)-240(e)15(xtremely)-241(good)-240(results;)-244(it)-240(turns)-241(out)-240(the)-241(additional)-240(data)-241(repre-)]TJ
T*
[(sentation)-300(of)-300(frequenc)15(y-based)-300(modeling)-300(is)-300(less)-301(adv)25(antageous)-300(when)]TJ
T*
[(the)-197(space)-198(of)-197(potential)-198(grams)-197(gro)25(ws)-198(signi\223cantly)-197(\(e.g.,)-208(the)-198(lik)10(elihood)]TJ
T*
[(of)-375(ha)20(ving)-374(signi\223cant)-375(frequenc)15(y)-374(information)-375(for)-374(distinct)-375(5-grams,)]TJ
T*
(or)Tj
/T1_3 1 Tf
1.2317 0 Td
(256)Tj
/T1_5 1 Tf
5.9776 0 0 5.9776 78.66541 99.43001 Tm
(5)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 86.39149 95.621 Tm
[(grams,)-436(is)-399(signi\223cantly)-399(smaller)-399(than)-399(for)-398(the)-399(256)-399(distinct)]TJ
ET
0 G
0.39799 w 10 M 0 j 0 J []0 d 
53.798 85.36501 m
149.438 85.36501 l
S
BT
/T1_0 1 Tf
5.9776 0 0 5.9776 54.79449 78.4989 Tm
(1)Tj
8.9664 0 0 8.9664 58.28149 74.6899 Tm
[(Anagram)-250(utilizes)-250(other)-250(information)-250(and)-250(is)-250(semi-supervised.)]TJ
28.8333 72.8887 Td
[(1-gram\),)-393(and)-365(the)-364(representational)-365(po)25(wer)-365(of)-364(higher)20(-order)-365(n-grams)]TJ
T*
[(ef)25(fecti)25(v)15(ely)-250(of)25(fsets)-250(the)-250(loss)-250(of)-250(frequenc)15(y)-250(information.)]TJ
1 -1.1667 Td
[(The)-298(structure)-297(of)-298(a)-298(ra)15(w)-297(Anagram)-298(alert)-298(is)-297(similar)-298(to)-298(that)-297(of)-298(a)-298(ra)15(w)]TJ
-1 -1.1667 Td
[(P)92(A)105(YL)-250(alert.)]TJ
/T1_4 1 Tf
10.95889 0 0 10.95889 319.55161 678.55035 Tm
[(2.2.1)-1000(Bloom)-250(\223lter)10(s)]TJ
/T1_0 1 Tf
8.9664 0 0 8.9664 325.77838 665.59906 Tm
[(Ev)15(en)-281(though)-281(binary-based)-281(modeling)-281(signi\223cantly)-281(reduces)-281(space)]TJ
-1 -1.1667 Td
[(o)15(v)15(erhead,)-278(there)-272(is)-272(still)-272(a)-273(signi\223cant)-272(number)-272(of)-272(possible)-272(n-grams)-273(as)]TJ
/T1_2 1 Tf
T*
(n)Tj
/T1_0 1 Tf
0.8437 0 Td
[(increases,)-229(and)-224(a)-223(typical)-224(hash)-224(set)-224(structure)-223(uses)-224(at)-224(least)-223(4)-224(bytes)-224(per)]TJ
-0.8437 -1.1667 Td
[(entry)65(.)-523(Since)-321(only)-321(the)-321(binary)-320(set)-321(property)-321(is)-321(needed,)-339(we)-321(can)-321(use)-321(a)]TJ
T*
[(more)-196(ef)25(\223cient,)-207(bit-based)-195(representation)-196(to)-195(store)-196(the)-195(model,)-207(reducing)]TJ
T*
[(data)-291(requirements)-291(by)-291(an)-291(order)-291(of)-291(magnitude.)-433(A)]TJ
/T1_4 1 Tf
19.4377 0 Td
[(Bloom)-291(\223lter)]TJ
/T1_0 1 Tf
5.1049 0 Td
[([5])-291(is)]TJ
-24.5426 -1.1667 Td
[(one)-290(such)-290(structure;)-311(it)-290(is)-290(represented)-290(as)-290(a)-291(bit)-290(array)-290(of)]TJ
/T1_2 1 Tf
21.31821 0 Td
(n)Tj
/T1_0 1 Tf
0.9102 0 Td
[(bits,)-300(where)]TJ
-22.22839 -1.1667 Td
[(an)15(y)-250(indi)25(vidual)-250(bit)]TJ
/T1_2 1 Tf
7.2659 0 Td
(i)Tj
/T1_0 1 Tf
0.6017 0 Td
[(is)-250(set)-250(if)-250(the)-250(hash)-250(of)-250(an)-250(input)-250(v)25(alue,)]TJ
/T1_6 1 Tf
13.9178 0 Td
(mod)Tj
/T1_2 1 Tf
2.05 0 Td
(n)Tj
/T1_0 1 Tf
0.25 Tc 0.62 0 Td
[(,i)250(s)]TJ
/T1_2 1 Tf
0 Tc 1.41701 0 Td
(i)Tj
/T1_0 1 Tf
0.3517 0 Td
(.)Tj
-0.00011 Tc -25.224 -1.1667 Td
[(A)-235(Bloom)-235(\223lter)-235(contains)-235(no)-235(f)10(alse)-235(ne)15(gati)25(v)15(es,)-238(b)20(ut)-235(may)-235(contain)-235(f)10(alse)]TJ
0 Tc -1 -1.1667 Td
[(positi)25(v)15(es)-214(if)-213(collisions)-214(occur;)-226(the)-213(f)10(alse)-214(positi)25(v)15(e)-214(rate)-213(can)-214(be)-214(optimized)]TJ
T*
[(by)-270(changing)-270(the)-270(size)-271(of)-270(the)-270(bit)-270(array)-270(to)-270(a)20(v)20(oid)-270(saturation,)-275(as)-271(well)-270(as)]TJ
T*
[(using)-318(multiple)-319(hash)-318(functions)-318(\(and)-319(requiring)-318(all)-318(of)-319(them)-318(to)-318(be)-319(set)]TJ
T*
[(for)-219(an)-220(item)-219(to)-219(be)-220(v)15(eri\223ed)-219(as)-220(present)-219(in)-219(the)-220(Bloom)-219(\223lter\).)-300(Operations)]TJ
T*
[(on)-319(a)-320(Bloom)-319(\223lter)-320(are)-319(also)]TJ
/T1_2 1 Tf
10.80431 0 Td
(O)Tj
/T1_3 1 Tf
0.0002 Tc 0.81059 0 Td
(\(1\))Tj
/T1_0 1 Tf
0 Tc 1.31329 0 Td
[(,)-337(k)10(eeping)-319(computational)-319(o)15(v)15(erhead)]TJ
-12.92821 -1.1667 Td
[(lo)25(w)65(.)-294(Finally)65(,)-212(a)-203(Bloom)-203(\223lter)-203(has)-202(interesting)-203(pri)25(v)25(ac)15(y-preserving)-203(prop-)]TJ
T*
[(erties;)-250(we)-250(e)15(xplore)-250(these)-250(in)-250(the)-250(ne)15(xt)-250(section.)]TJ
/T1_1 1 Tf
11.9552 0 0 11.9552 316.81201 485.02588 Tm
[(3.)-1000(CORRELA)95(TION)-250(TECHNIQ)10(UES)]TJ
/T1_0 1 Tf
8.9664 0 0 8.9664 325.77838 472.0744 Tm
[(In)-407(this)-406(section,)-446(we)-407(describe)-407(se)25(v)15(eral)-407(techniques)-407(\(both)-407(ra)15(w)-407(and)]TJ
-1 -1.1667 Td
[(pri)25(v)25(ac)15(y-preserving\))-190(to)-190(support)-190(content-based)-190(alert)-190(correlation.)-290(First,)]TJ
T*
[(ho)25(we)25(v)15(er)40(,)-336(we)-319(de)25(v)15(elop)-318(se)25(v)15(eral)-319(metrics)-319(as)-318(to)-319(ho)25(w)-319(we)-318(can)-319(best)-319(com-)]TJ
T*
[(pare)-250(these)-250(techniques.)]TJ
/T1_1 1 Tf
11.9552 0 0 11.9552 316.81201 422.3858 Tm
[(3.1)-1000(Ev)10(aluating)-250(corr)18(elation)-250(techniques)]TJ
/T1_0 1 Tf
8.9664 0 0 8.9664 325.77838 409.4343 Tm
[(The)-331(techniques)-331(described)-331(in)-330(this)-331(paper)-330(essentially)-331(trade)-330(of)25(f)-331(the)]TJ
-1 -1.1667 Td
[(amount)-405(of)-405(information)-404(contained)-405(v)15(ersus)-405(the)-405(pri)25(v)25(ac)15(y)-405(maintained.)]TJ
T*
[(On)-303(one)-302(e)15(xtreme,)-316(we)-303(can)-302(consider)-303(the)-302(idea)-303(of)-303(transmitting)-303(the)-303(ra)15(w)]TJ
T*
[(pack)10(ets)-417(that)-417(generated)-417(alerts;)-501(while)-417(this)-417(enables)-417(an)15(y)-417(correlation)]TJ
T*
[(technique,)-378(we)-353(consider)-353(it)-353(infeasible)-353(because)-352(of)-353(the)-353(sheer)-353(amount)]TJ
T*
[(of)-225(data)-224(and)-225(the)-225(f)10(act)-224(it)-225(is)-225(not)-224(pri)25(v)25(ac)15(y-preserving.)-302(On)-225(the)-224(other)-225(end)-225(of)]TJ
T*
[(the)-282(spectrum,)-291(we)-282(can)-282(consider)-282(pri)25(v)25(ately-encrypted)-282(pack)10(et)-283(content:)]TJ
T*
[(unless)-302(the)-302(k)10(e)15(y)-302(is)-302(shared,)-315(it)-302(essentially)-302(appears)-302(as)-302(noise)-302(to)-302(peers\204)]TJ
T*
[(b)20(ut)-337(this)-338(requires)-337(all)-337(or)-338(no)-337(trust.)-572(The)-337(techniques)-338(in)-337(this)-337(paper)-338(f)10(all)]TJ
T*
[(some)25(where)-377(in)-377(between,)-409(and)-377(we)-377(characterize)-377(their)-377(relati)25(v)15(e)-377(merits)]TJ
T*
[(from)-319(tw)10(o)-319(perspecti)25(v)15(es:)-448(our)-318(ability)-319(to)-319(correlate)-319(data)-319(gi)25(v)15(en)-319(a)-319(trans-)]TJ
-0.00011 Tc T*
[(formed)-252(v)15(ersion)-252(of)-252(pack)10(ets)-251(and)-252(the)-251(amount)-252(of)-251(pri)25(v)25(ac)15(y)-252(that)-251(is)-252(gained)]TJ
0 Tc T*
[(using)-351(dif)25(ferent)-351(pri)25(v)25(ac)15(y-preserving)-351(transformations)-351(of)-352(pack)10(et)-351(con-)]TJ
T*
(tent.)Tj
/T1_1 1 Tf
1 -1.1667 Td
[(Corr)18(elation)-268(ability)70(.)]TJ
/T1_0 1 Tf
8.5174 0 Td
[(The)-268(fundamental)-269(question,)-273(gi)25(v)15(en)-268(an)15(y)-268(tech-)]TJ
-9.5174 -1.1667 Td
[(nique,)-415(is)-382(whether)-381(it)-382(is)-382(possible)-382(to)-382(correlate)-381(alerts)-382(with)-382(lo)25(w)-382(f)10(alse)]TJ
-0.00011 Tc T*
[(positi)25(v)15(e)-297(and)-297(lo)25(w)-297(f)10(alse)-297(ne)15(gati)25(v)15(e)-296(rates.)-451(Gi)25(v)15(en)-297(ra)15(w)-297(pack)10(ets)-297(that)-297(gen-)]TJ
0 Tc T*
[(erate)-381(an)-381(alert,)-414(there)-382(are)-381(se)25(v)15(eral)-381(well-de\223ned)-381(algorithms)-381(that)-382(aim)]TJ
T*
[(to)-339(accomplish)-339(this)-339(task.)-576(W)80(e)-339(consider)-339(the)]TJ
/T1_4 1 Tf
17.1669 0 Td
[(long)10(est)-339(common)-339(subse-)]TJ
-17.1669 -1.1667 Td
(quence)Tj
/T1_0 1 Tf
2.832 0 Td
[(,)-329(or)-314(LCSeq,)-329(as)-314(an)-313(appropriate)-314(baseline,)-329(as)-314(it)-313(is)-314(able)-313(to)-314(\223nd)]TJ
-2.832 -1.1667 Td
[(an)15(y)-318(non-semantic)-318(commonality)-317(in)-318(the)-317(candidate)-318(pack)10(ets,)-334(and)-318(dis-)]TJ
T*
[(cuss)-267(it)-266(belo)25(w)65(.)-360(Other)-266(approaches,)-271(including)-267(semantic)-267(matching,)-271(are)]TJ
T*
[(discussed)-248(brie\224y)-247(in)-248(section)-247(5,)-249(and)-247(are)-248(considered)-247(outside)-248(the)-248(scope)]TJ
T*
[(of)-304(this)-304(paper)40(,)-318(which)-304(focuses)-304(on)-304(correlation)-304(amongst)-304(pure)-304(netw)10(ork)]TJ
T*
[(sensors,)-250(i.e.)-310(no)-250(host-speci\223c)-250(information.)]TJ
1 -1.1667 Td
[(Gi)25(v)15(en)-295(a)-295(technique,)-307(and)-295(a)-295(collection)-295(of)-295(alerts,)-306(we)-295(can)-296(then)-295(com-)]TJ
-1 -1.1667 Td
[(pute)-334(a)]TJ
/T1_4 1 Tf
2.8334 0 Td
[(similarity)-334(scor)37(e)-333(distrib)20(ution)]TJ
/T1_0 1 Tf
11.612 0 Td
[(as)-334(each)-333(pair)-334(of)-334(alerts)-334(is)-333(tested)]TJ
-14.4454 -1.1667 Td
[(\(see)-386(section)-385(4.1\).)-717(This)-386(score)-385(distrib)20(ution)-386(then)-385(becomes)-386(a)-386(useful)]TJ
T*
[(metric)-224(for)-225(comparing)-224(correlation)-224(ability)65(.)-302(If)-224(we)-225(consider)-224(LCSeq)-224(as)-225(a)]TJ
T*
[(useful)-230(baseline,)-234(for)-230(instance,)-235(we)-230(can)-230(measure)-230(the)-230(de)25(viation)-230(of)-231(other)]TJ
T*
[(techniques)-397(from)-396(LCSeq)-397(as)-397(a)-397(comparati)25(v)15(e)-396(measure)-397(of)-397(ho)25(w)-397(other)]TJ
T*
[(techniques)-230(correlate)-230(alerts.)-303(Ideally)65(,)-234(a)-230(netw)10(ork)-231(sensor)-231(w)10(ould)-230(be)-230(able)]TJ
T*
[(to)-270(use)-269(a)-270(pri)25(v)25(ac)15(y-enabled)-269(technique)-270(and)-269(get)-270(similar)-269(results,)-275(signify-)]TJ
ET
q
/RelativeColorimetric ri
/GS1 gs
/Fm0 Do
Q

0 g
1 i 
/RelativeColorimetric ri
/GS0 gs
BT
/T1_0 1 Tf
0 Tc 0 Tw 0  Ts 100  Tz 0 Tr 8.9664 0 0 8.9664 53.79829 728.23907 Tm
[(padding)-322(\215noise\216.)-526(Results)-322(with)-322(dif)25(ferent)-322(n-gram)-322(sizes)-322(and)-322(another)]TJ
0 -1.1667 TD
[(CRII)-310(pack)10(et)-310(are)-310(presented)-311(in)-310(an)-310(appendix)-310(in)-310(the)-311(e)15(xtended)-311(v)15(ersion)]TJ
T*
[(of)-250(this)-250(paper)-250(on)-250(our)-250(website)-250([31].)]TJ
ET
0 G
0.39799 w 10 M 0 j 0 J []0 d 
53.798 696.28705 m
292.90201 696.28705 l
53.99701 693.39801 m
53.99701 696.08801 l
292.70203 693.39801 m
292.70203 696.08801 l
53.99701 682.93805 m
53.99701 693.39801 l
S
BT
/T1_1 1 Tf
8.9664 0 0 8.9664 56.8867 684.50677 Tm
(*)Tj
1.2 0.175 Td
(/def)Tj
2.39999 -0.175 Td
(*)Tj
0.60001 0.175 Td
(ult.ida?XXXX)Tj
7.2 -0.175 Td
(*)Tj
0.60001 0.175 Td
(XXXX%u9090%u6858%ucbd3%)Tj
ET
292.70203 682.93805 m
292.70203 693.39801 l
53.99701 672.47705 m
53.99701 682.93805 l
S
BT
/T1_1 1 Tf
8.9664 0 0 8.9664 56.8867 675.61517 Tm
(u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%u)Tj
ET
292.70203 672.47705 m
292.70203 682.93805 l
53.99701 662.01605 m
53.99701 672.47705 l
S
BT
/T1_1 1 Tf
8.9664 0 0 8.9664 56.8867 665.1543 Tm
(cbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8)Tj
ET
292.70203 662.01605 m
292.70203 672.47705 l
53.99701 651.55505 m
53.99701 662.01605 l
S
BT
/T1_1 1 Tf
8.9664 0 0 8.9664 56.8867 654.6936 Tm
[(b00%u531b%u53ff%u0078%u0000%u00=a)-600(HT)]TJ
21.5999 -0.175 Td
(*)Tj
0.60001 0.175 Td
[(:)-600(3379)]TJ
ET
292.70203 651.55505 m
292.70203 662.01605 l
53.99701 648.86505 m
53.99701 651.55505 l
292.70203 648.86505 m
292.70203 651.55505 l
53.798 648.66602 m
292.90201 648.66602 l
S
BT
/T1_2 1 Tf
8.9664 0 0 8.9664 53.79829 638.8031 Tm
[(Figur)18(e)-313(6:)-435(Generated)-313(5-gram)-313(signatur)18(e)-312(fr)18(om)-313(the)-313(CRII)-313(pack)10(et;)]TJ
T*
[(only)-250(the)-250(\223rst)-250(172)-250(bytes)-250(ar)18(e)-250(sho)10(wn)-250(f)25(or)-250(br)18(e)15(vity)70(.)]TJ
11.9552 0 0 11.9552 53.79829 600.21906 Tm
[(4.4)-1000(Measuring)-250(Pri)10(v)10(acy)-250(Gain)]TJ
/T1_0 1 Tf
8.9664 0 0 8.9664 62.76469 587.26758 Tm
[(As)-269(discussed)-269(earlier)40(,)-273(we)-269(can)-269(use)-269(a)-268(probabilistic)-269(model)-269(as)-269(a)-269(\223rst-)]TJ
-1 -1.1667 Td
[(order)-190(approximation)-190(to)-190(measure)]TJ
/T1_3 1 Tf
12.81281 0 Td
[(the)-190(r)37(elative)-190(privacy)]TJ
/T1_0 1 Tf
7.8089 0 Td
[(of)-190(each)-190(pri)25(v)25(ac)15(y-)]TJ
-20.6217 -1.1667 Td
[(preserving)-250(technique.)]TJ
/T1_2 1 Tf
1 -1.1667 Td
[(Fr)18(equency-based)-402(appr)18(oaches.)]TJ
/T1_0 1 Tf
13.6048 0 Td
[(Reco)15(v)15(ery)-402(of)-402(the)-403(original)-402(te)15(xt)]TJ
-14.6048 -1.1667 Td
[(from)-345(its)-345(pri)25(v)25(ac)15(y-preserving)-346(encoding)-345(can)-345(be)-345(modeled)-345(as)-346(follo)25(ws:)]TJ
T*
[(gi)25(v)15(en)-250(a)-250(frequenc)15(y)-250(distrib)20(ution)]TJ
/T1_4 1 Tf
12.2009 0 Td
(f)Tj
/T1_5 1 Tf
0.8931 0 Td
(=)Tj
/T1_6 1 Tf
1.0849 0 Td
({)Tj
/T1_5 1 Tf
0.5139 0 Td
(\()Tj
/T1_4 1 Tf
0.3997 0 Td
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 193.0721 533.96747 Tm
(0)Tj
/T1_4 1 Tf
0.17149 Tc 8.9664 0 0 8.9664 197.2231 534.96381 Tm
(,\001)Tj
/T1_7 1 Tf
0 Tc 5.9776 0 0 5.9776 206.59309 533.96747 Tm
(0)Tj
/T1_5 1 Tf
8.9664 0 0 8.9664 210.7442 534.96381 Tm
(\))Tj
/T1_4 1 Tf
0.3997 0 Td
(,)Tj
/T1_5 1 Tf
0.4568 0 Td
(\()Tj
/T1_4 1 Tf
0.3997 0 Td
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 225.9565 533.96747 Tm
(1)Tj
/T1_4 1 Tf
0.17149 Tc 8.9664 0 0 8.9664 230.1075 534.96381 Tm
(,\001)Tj
/T1_7 1 Tf
0 Tc 5.9776 0 0 5.9776 239.47749 533.96747 Tm
(1)Tj
/T1_5 1 Tf
8.9664 0 0 8.9664 243.62849 534.96381 Tm
(\))Tj
/T1_4 1 Tf
0.17149 Tc 0.3997 0 Td
[(,.)172(.)171(.)172(,)]TJ
/T1_5 1 Tf
0 Tc 1.77 0 Td
(\()Tj
/T1_4 1 Tf
0.3997 0 Td
(b)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 270.61609 533.96747 Tm
(n)Tj
/T1_9 1 Tf
0.7697 0 Td
(\212)Tj
/T1_7 1 Tf
0.963 0 Td
(1)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 285.12408 534.96381 Tm
(,)Tj
-25.79919 -1.1667 Td
(\001)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 59.0726 523.50671 Tm
(n)Tj
/T1_9 1 Tf
0.7697 0 Td
(\212)Tj
/T1_7 1 Tf
0.96291 0 Td
(1)Tj
/T1_5 1 Tf
8.9664 0 0 8.9664 73.5804 524.50287 Tm
(\))Tj
/T1_6 1 Tf
0.3997 0 Td
(})Tj
/T1_0 1 Tf
0.5139 0 Td
[(,)-371(where)]TJ
/T1_4 1 Tf
3.41 0 Td
(n)Tj
/T1_0 1 Tf
0.9664 0 Td
[(is)-346(the)-347(size)-346(of)-347(the)-346(alphabet,)]TJ
/T1_4 1 Tf
11.23959 0 Td
(b)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 225.74049 523.50671 Tm
(i)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 232.00859 524.50287 Tm
[(is)-346(the)-347(byte)-346(v)25(alue)]TJ
-19.8754 -1.1667 Td
[(with)-280(probability)]TJ
/T1_4 1 Tf
6.7262 0 Td
(\001)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 119.382 513.04602 Tm
(i)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 122.54381 514.04218 Tm
[(,)-287(and)-280(a)-279(tar)18(get)-280(length)]TJ
/T1_4 1 Tf
8.30251 0 Td
(l)Tj
/T1_0 1 Tf
0.3233 0 Td
[(,)-287(we)-280(construct)-279(the)-280(content)]TJ
-16.2928 -1.1667 Td
[(of)-392(a)-391(pack)10(et)]TJ
/T1_4 1 Tf
5.0518 0 Td
(p)Tj
/T1_5 1 Tf
1.07091 0 Td
(=)Tj
/T1_6 1 Tf
1.3544 0 Td
({)Tj
/T1_4 1 Tf
0.5139 0 Td
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 129.39749 502.58508 Tm
(0)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 133.54849 503.58139 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 137.49759 502.58508 Tm
(0)Tj
/T1_4 1 Tf
-0.00031 Tc 8.9664 0 0 8.9664 141.64859 503.58139 Tm
(...b)Tj
/T1_7 1 Tf
0 Tc 5.9776 0 0 5.9776 153.2771 502.58508 Tm
(0)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 157.42819 503.58139 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 161.3772 502.58508 Tm
(1)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 165.52829 503.58139 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 169.47729 502.58508 Tm
(1)Tj
/T1_4 1 Tf
-0.00031 Tc 8.9664 0 0 8.9664 173.6284 503.58139 Tm
(...b)Tj
/T1_7 1 Tf
0 Tc 5.9776 0 0 5.9776 185.2569 502.58508 Tm
(1)Tj
/T1_6 1 Tf
0.17149 Tc 8.9664 0 0 8.9664 190.94389 503.58139 Tm
(\267\267\267)Tj
/T1_4 1 Tf
0 Tc 1.3703 0 Td
(b)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 207.1801 502.58508 Tm
(n)Tj
/T1_9 1 Tf
0.7697 0 Td
(\212)Tj
/T1_7 1 Tf
0.96291 0 Td
(1)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 221.6881 503.58139 Tm
(b)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 225.6371 502.58508 Tm
(n)Tj
/T1_9 1 Tf
0.7697 0 Td
(\212)Tj
/T1_7 1 Tf
0.96291 0 Td
(1)Tj
/T1_4 1 Tf
-0.00031 Tc 8.9664 0 0 8.9664 240.1451 503.58139 Tm
(...b)Tj
/T1_8 1 Tf
0 Tc 5.9776 0 0 5.9776 251.77359 502.58508 Tm
(n)Tj
/T1_9 1 Tf
0.7697 0 Td
(\212)Tj
/T1_7 1 Tf
0.96291 0 Td
(1)Tj
/T1_6 1 Tf
8.9664 0 0 8.9664 266.28159 503.58139 Tm
(})Tj
/T1_0 1 Tf
0.5139 0 Td
[(,)-427(with)]TJ
/T1_4 1 Tf
-24.21159 -1.1667 Td
(\001)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 59.07249 492.1243 Tm
(0)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 63.2235 493.1207 Tm
(l)Tj
/T1_0 1 Tf
0.5733 0 Td
[(copies)-250(of)]TJ
/T1_4 1 Tf
3.888 0 Td
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 107.1739 492.1243 Tm
(0)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 111.32501 493.1207 Tm
(,)Tj
/T1_4 1 Tf
0.5 0 Td
(\001)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 121.0825 492.1243 Tm
(1)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 125.23351 493.1207 Tm
(l)Tj
/T1_0 1 Tf
0.5733 0 Td
[(copies)-250(of)]TJ
/T1_4 1 Tf
3.888 0 Td
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 169.1839 492.1243 Tm
(1)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 173.33501 493.1207 Tm
[(,)-250(and)-250(so)-250(on.)]TJ
-12.3316 -1.1667 Td
[(W)80(e)-250(can)-250(no)25(w)-250(characterize)-250(the)]TJ
/T1_3 1 Tf
11.69479 0 Td
[(r)37(eco)10(very)-250(lik)10(elihood)]TJ
/T1_4 1 Tf
7.9679 0 Td
(R)Tj
/T1_5 1 Tf
0.2856 Tc 1.07021 0 Td
(=1)Tj
/T1_4 1 Tf
0 Tc 1.59869 0 Td
(/)Tj
/T1_5 1 Tf
-23.3316 -1.1667 Td
(\()Tj
/T1_4 1 Tf
0.3997 0 Td
(l)Tj
/T1_5 1 Tf
0.3233 0 Td
(!)Tj
/T1_4 1 Tf
0.28551 0 Td
(/)Tj
/T1_5 1 Tf
0.00031 Tc 0.5139 0 Td
(\(\()Tj
/T1_4 1 Tf
0 Tc 0.79939 0 Td
(\001)Tj
/T1_5 1 Tf
0.6241 0 Td
(0)Tj
/T1_4 1 Tf
0.5139 0 Td
(l)Tj
/T1_5 1 Tf
-0.00011 Tc 0.3233 0 Td
(\)!\()Tj
/T1_4 1 Tf
0 Tc 1.0849 0 Td
(\001)Tj
/T1_5 1 Tf
0.6241 0 Td
(1)Tj
/T1_4 1 Tf
0.5139 0 Td
(l)Tj
/T1_5 1 Tf
0.00031 Tc 0.3233 0 Td
(\)!)Tj
/T1_4 1 Tf
0 Tc 0.6852 0 Td
(...)Tj
/T1_5 1 Tf
0.85651 0 Td
(\()Tj
/T1_4 1 Tf
0.0358 Tc 0.3997 0 Td
(\001n)Tj
/T1_6 1 Tf
0 Tc 1.4725 0 Td
(\212)Tj
/T1_5 1 Tf
1.0278 0 Td
(1)Tj
/T1_4 1 Tf
0.5139 0 Td
(l)Tj
/T1_5 1 Tf
0.00011 Tc 0.3233 0 Td
(\)!\)\))Tj
/T1_0 1 Tf
0 Tc 1.4846 0 Td
[(,)-244(where)-243(the)-242(denominator)-243(is)-242(simply)]TJ
-13.0925 -1.1667 Td
[(the)-287(count)-287(of)-288(all)-287(permutations)-287(of)]TJ
/T1_4 1 Tf
13.0551 0 Td
(p)Tj
/T1_0 1 Tf
0.5159 0 Td
[(.)-422(This)-287(is)-287(an)-287(ef)25(fecti)25(v)15(e)-287(estimate)-288(of)]TJ
-13.57111 -1.1667 Td
[(the)-313(pri)25(v)25(ac)15(y)-312(of)-313(the)-313(frequenc)15(y)-313(distrib)20(ution,)-328(as)-313(it)-312(represents)-313(the)-313(lik)10(e-)]TJ
T*
[(lihood)-325(an)-324(attack)10(er)-325(will)-324(be)-325(able)-325(to)-324(correctly)-325(guess)-324(the)-325(true)-325(content)]TJ
T*
[(of)-331(the)-330(original)-331(pack)10(ets.)-552(This)-331(number)-331(is,)-351(additionally)65(,)-351(v)25(anishingly)]TJ
T*
[(small.)-435(F)15(or)-292(the)-291(frequenc)15(y)-292(distrib)20(ution)-292(of)-291(the)-292(CRII)-291(pack)10(et)-292(sho)25(wn)-292(in)]TJ
T*
[(\223gure)-214(4,)]TJ
/T1_4 1 Tf
3.51891 0 Td
(R)Tj
/T1_6 1 Tf
1.07021 0 Td
(\003)Tj
/T1_5 1 Tf
1.0849 0 Td
(1)Tj
/T1_4 1 Tf
0.5139 0 Td
(/)Tj
/T1_5 1 Tf
0.5139 0 Td
(2)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 118.49609 413.24338 Tm
(8208)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 133.6059 409.43439 Tm
[(,)-222(well)-214(be)15(yond)-214(the)-215(scope)-214(of)-214(feasibility)65(,)-222(despite)]TJ
-8.9008 -1.1667 Td
[(the)-250(pack)10(et\220)55(s)-250(re)15(gularity)-250(thanks)-250(to)-250(the)-250(lar)18(ge)-250(padded)-250(section.)]TJ
1 -1.1667 Td
[(The)-195(v)25(alue)-195(of)]TJ
/T1_4 1 Tf
5.1136 0 Td
(R)Tj
/T1_0 1 Tf
0.9796 0 Td
[(for)-195(a)-195(Z-String)-195(is)-194(orders-of-magnitude)-195(smaller;)-213(not)]TJ
-7.0932 -1.1667 Td
[(only)-244(do)-245(permutations)-245(of)-244(a)-244(pack)10(et)]TJ
/T1_4 1 Tf
13.34241 0 Td
(p)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 178.0578 377.05569 Tm
(i)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 183.4097 378.05188 Tm
[(ha)20(v)15(e)-244(to)-245(be)-244(computed,)-245(there)-244(are)]TJ
-14.45531 -1.1667 Td
[(man)15(y)-306(such)-306(pack)10(ets;)-334(since)-305(no)-306(frequenc)15(y)-306(information)-306(is)-306(stored,)-320(one)]TJ
T*
[(must)-227(guess)-227(the)-228(frequencies)-227(for)-227(each)-227(of)-227(the)-227(bytes)]TJ
/T1_4 1 Tf
19.2066 0 Td
(b)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 229.96129 356.13419 Tm
(i)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 235.16019 357.1304 Tm
[(in)-227(the)-227(pack)10(et.)-303(In)]TJ
-20.2269 -1.1667 Td
[(short,)-227(ef)25(fecti)25(v)15(ely)-220(guessing)-221(the)-221(correct)-221(base)-221(pack)10(et)]TJ
/T1_4 1 Tf
19.8876 0 Td
(p)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 236.74402 345.6734 Tm
(i)Tj
/T1_3 1 Tf
8.9664 0 0 8.9664 241.8862 346.66959 Tm
(and)Tj
/T1_0 1 Tf
1.7478 0 Td
[(its)-221(correct)]TJ
-22.72481 -1.1667 Td
[(permutation)-250(is)-250(intractable.)]TJ
/T1_2 1 Tf
1 -1.1667 Td
(N-grams.)Tj
/T1_0 1 Tf
4.6899 0 Td
[(W)80(e)-386(can)-387(consider)-386(the)-386(pri)25(v)25(ac)15(y)-387(of)-386(both)-386(a)-386(ra)15(w)-387(collec-)]TJ
-5.6899 -1.1667 Td
[(tion)-341(of)-341(n-grams)-340(and)-341(a)-341(corresponding)-341(Bloom)-341(\223lter)-341(encoding.)-583(The)]TJ
T*
[(ra)15(w)-311(collection)-310(is)]TJ
/T1_3 1 Tf
7.02721 0 Td
(not)Tj
/T1_0 1 Tf
1.6067 0 Td
[(v)15(ery)-311(pri)25(v)25(ac)15(y-preserving;)-341(not)-311(only)-310(can)-311(a)-311(byte)]TJ
-8.6339 -1.1667 Td
[(sequence)-336(contain)-336(v)25(aluable)-336(information)-337(\(e.g.,)-357(an)-337(entire)-336(passw)10(ord\),)]TJ
T*
[(signi\223cant)-382(n-gram)-383(collections)-382(enable)-383(reassembly)-382(of)-383(much)-382(of)-383(the)]TJ
T*
[(original)-223(pack)10(et,)-229(e)25(v)15(en)-224(without)-223(position)-224(information.)-301(Gi)25(v)15(en)-223(a)-224(5-gram)]TJ
/T1_6 1 Tf
T*
({)Tj
/T1_4 1 Tf
0.5139 0 Td
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 62.35501 261.98718 Tm
(1)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 66.50601 262.98331 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 70.45511 261.98718 Tm
(2)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 74.60609 262.98331 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 78.55521 261.98718 Tm
(3)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 82.70621 262.98331 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 86.6553 261.98718 Tm
(4)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 90.8063 262.98331 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 94.7554 261.98718 Tm
(5)Tj
/T1_6 1 Tf
8.9664 0 0 8.9664 98.9064 262.98331 Tm
(})Tj
/T1_0 1 Tf
0.7639 0 Td
[(from)-250(pack)10(et)]TJ
/T1_4 1 Tf
5.0439 0 Td
(p)Tj
/T1_0 1 Tf
0.5159 0 Td
[(,)-250(one)-250(can)-250(search)-250(for)-250(the)-250(5-gram)]TJ
/T1_6 1 Tf
-11.3546 -1.1667 Td
({)Tj
/T1_4 1 Tf
0.5139 0 Td
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 62.35501 251.52629 Tm
(2)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 66.50601 252.52249 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 70.45511 251.52629 Tm
(3)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 74.60609 252.52249 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 78.55521 251.52629 Tm
(4)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 82.70621 252.52249 Tm
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 86.6553 251.52629 Tm
(5)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 90.8063 252.52249 Tm
(b)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 94.7554 251.52629 Tm
(x)Tj
/T1_6 1 Tf
8.9664 0 0 8.9664 99.42531 252.52249 Tm
(})Tj
/T1_0 1 Tf
0.7621 0 Td
[(in)-248(the)-248(collection,)-249(where)]TJ
/T1_4 1 Tf
9.6302 0 Td
(b)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 196.5562 251.52629 Tm
(x)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 203.45209 252.52249 Tm
[(is)-248(an)15(y)-248(byte;)-249(if)-249(found,)-248(one)]TJ
-16.69051 -1.1667 Td
[(can)-323(reasonably)-324(assume)-324(the)-323(presence)-323(of)-324(the)-323(6-gram)]TJ
/T1_6 1 Tf
20.9131 0 Td
({)Tj
/T1_4 1 Tf
0.5139 0 Td
(b)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 249.86969 241.06549 Tm
(1)Tj
/T1_4 1 Tf
-0.00031 Tc 8.9664 0 0 8.9664 254.0208 242.0618 Tm
(...b)Tj
/T1_7 1 Tf
0 Tc 5.9776 0 0 5.9776 265.64929 241.06549 Tm
(5)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 269.80038 242.0618 Tm
(b)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 273.74939 241.06549 Tm
(x)Tj
/T1_6 1 Tf
8.9664 0 0 8.9664 278.4194 242.0618 Tm
(})Tj
/T1_0 1 Tf
0.8372 0 Td
(in)Tj
-25.8886 -1.1667 Td
[(pack)10(et)]TJ
/T1_4 1 Tf
2.8551 0 Td
(p)Tj
/T1_0 1 Tf
0.5159 0 Td
[(;)-258(since)]TJ
/T1_5 1 Tf
2.8459 0 Td
(256)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 123.36459 235.40999 Tm
(4)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 127.5157 231.60101 Tm
[(,)-256(the)-256(number)-255(of)-255(\215common\216)-255(4-grams)-255(contained)]TJ
-8.2215 -1.1667 Td
[(in)-407(both)-408(tw)10(o)-407(5-grams,)-447(is)-407(much)-408(greater)-407(than)-408(a)-407(pack)10(et\220)55(s)-408(s)1(ize,)-447(it)-408(is)]TJ
T*
[(highly)-351(unlik)10(ely)-352(that)-351(the)-351(common)-351(4-gram)-352(happens)-351(to)-351(be)-351(a)-352(coinci-)]TJ
T*
[(dence.)-328(Combined)-256(with)-256(the)-256(f)10(act)-256(that)-256(high-scoring)-256(alerts)-256(can)-256(contain)]TJ
T*
[(nearly)-217(as)-216(man)15(y)-217(n-grams)-217(as)-217(the)-216(original)-217(pack)10(et\220)55(s)-217(size,)-223(this)-217(is)-217(imprac-)]TJ
T*
[(tical)-250(from)-250(a)-250(pri)25(v)25(ac)15(y)-250(perspecti)25(v)15(e.)]TJ
1 -1.1667 Td
[(Instead,)-396(as)-368(pre)25(viously)-368(proposed,)-396(we)-367(insert)-367(the)-367(collection)-368(of)-367(n-)]TJ
-1 -1.1667 Td
[(grams)-408(into)-408(a)-408(Bloom)-408(\223lter)-407(before)-408(publishing)-408(it.)-784(The)-408(size)-408(of)-408(the)]TJ
T*
[(Bloom)-298(\223lter)-298(need)-299(not)-298(be)-298(much)-298(more)-299(than)-298(the)-298(number)-298(of)-299(n-grams;)]TJ
T*
[(we)-277(can)-278(pick)-277(a)-278(size,)-284(say)]TJ
/T1_5 1 Tf
9.52969 0 Td
(2)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 143.85339 141.263 Tm
(12)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 154.14549 137.45401 Tm
[(bits,)-284(which)-278(is)-277(more)-278(than)-277(twice)-278(the)-277(size)]TJ
-11.1915 -1.1667 Td
[(of)-219(an)15(y)-218(indi)25(vidual)-219(pack)10(et)-218(and)-219(not)-218(prone)-219(to)-219(signi\223cant)-218(f)10(alse)-219(positi)25(v)15(es.)]TJ
T*
[(\(This)-273(Bloom)-273(\223lter)-274(still)-274(tak)10(es)-273(substantially)-273(less)-273(memory)-273(than)-273(the)-274(n-)]TJ
T*
[(gram)-271(collection)-271(itself.\))-372(Gi)25(v)15(en)-271(such)-271(an)-271(encoding,)-276(the)-271(only)-271(practical)]TJ
T*
[(w)10(ay)-332(of)-333(reco)15(v)15(ering)-332(the)-333(data)-332(is)-333(to)-332(brute-force)-333(v)15(erify)-332(e)25(v)15(ery)-333(possible)]TJ
-0.00011 Tc T*
[(n-gram)-236(against)-237(the)-236(Bloom)-237(\223lter)55(.)-305(F)15(or)-237(e)15(xample,)-239(if)-236(we)-237(kno)25(w)-236(that)-237(only)]TJ
0 Tc T*
[(5-grams)-381(are)-381(contained)-382(in)-381(the)-381(Bloom)-381(\223lter)40(,)-414(there)-382(are)]TJ
/T1_5 1 Tf
21.8918 0 Td
(256)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 263.91168 78.4984 Tm
(5)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 271.48129 74.68941 Tm
(possi-)Tj
5.0556 72.8887 Td
[(ble)-285(n-grams.)-415(Not)-285(only)-285(is)-286(testing)-286(all)-285(such)-285(n-grams)-285(computationally)]TJ
T*
[(infeasible,)-341(a)-323(brute-force)-323(attempt)-323(is)-323(lik)10(ely)-323(to)-323(generate)-323(man)15(y)65(,)-342(man)15(y)]TJ
T*
[(f)10(alse)-255(positi)25(v)15(es,)-256(since)-255(there)-254(are)]TJ
/T1_5 1 Tf
12.19279 0 Td
(256)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 439.96008 711.12585 Tm
(5)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 444.11102 707.31689 Tm
(/)Tj
/T1_5 1 Tf
0.5139 0 Td
(2)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 453.32639 711.12585 Tm
(12)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 463.4129 707.31689 Tm
[(possible)-255(n-grams)-255(for)-255(each)]TJ
-16.3501 -1.1667 Td
[(set)-344(bit)-345(in)-344(the)-344(Bloom)-345(\223lter)-344(\(assuming)-344(one)-345(hash)-344(function)]TJ
5.9776 0 0 5.9776 519.44238 700.66504 Tm
(5)Tj
8.9664 0 0 8.9664 522.92926 696.85608 Tm
[(\);)-392(the)-344(re-)]TJ
-22.98779 -1.1667 Td
[(co)15(v)15(ery)-326(lik)10(elihood)]TJ
/T1_4 1 Tf
7.38831 0 Td
(R)Tj
/T1_5 1 Tf
0.4296 Tc 1.2142 0 Td
[(=\()429(2)]TJ
/T1_7 1 Tf
0 Tc 5.9776 0 0 5.9776 413.15558 690.20428 Tm
(12)Tj
/T1_4 1 Tf
8.9664 0 0 8.9664 420.95959 686.39526 Tm
(/)Tj
/T1_5 1 Tf
0.5139 0 Td
(256)Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 439.39029 690.20428 Tm
(5)Tj
/T1_5 1 Tf
8.9664 0 0 8.9664 443.54138 686.39526 Tm
(\))Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 447.12509 690.20428 Tm
(m)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 454.16119 686.39526 Tm
[(,)-345(where)]TJ
/T1_4 1 Tf
3.3633 0 Td
(m)Tj
/T1_0 1 Tf
1.2312 0 Td
[(is)-326(the)-325(number)-326(of)]TJ
-0.00011 Tc -19.9126 -1.1667 Td
[(n-grams)-253(reco)15(v)15(ered,)-253(is)-253(again)-253(v)25(anishingly)-253(small.)-318(This)-253(number)-253(gro)25(ws)]TJ
0 Tc T*
[(e)25(v)15(en)-371(smaller)-371(if)-372(multiple)-372(n-gram)-371(sizes)-371(are)-371(embedded)-371(in)-372(the)-371(same)]TJ
T*
[(Bloom)-250(\223lter)55(.)]TJ
1 -1.1667 Td
[(Interestingly)65(,)-216(despite)-207(the)-208(number)-207(of)-207(possible)-208(n-grams)-207(for)-207(each)-208(bit)]TJ
-1 -1.1667 Td
[(of)-196(the)-195(Bloom)-196(\223lter)40(,)-206(correlating)-196(such)-195(\223lters)-196(is)]TJ
/T1_3 1 Tf
17.5621 0 Td
(not)Tj
/T1_0 1 Tf
1.4915 0 Td
[(prone)-196(to)-195(signi\223cant)]TJ
-19.0536 -1.1667 Td
[(misclassi\223cation.)-524(W)80(e)-321(can)-322(characterize)-321(the)-321(\215unluck)15(y)-322(coincidence\216)]TJ
0 -1.4454 TD
(rate)Tj
/T1_5 1 Tf
0.2856 Tc 1.7278 0 Td
(=\()Tj
/T1_7 1 Tf
0 Tc 5.9776 0 0 5.9776 346.81009 614.97461 Tm
(256)Tj
/T1_10 1 Tf
4.98129 0 0 4.98129 357.76889 617.48303 Tm
(5)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 361.6571 614.97461 Tm
(/)Tj
/T1_7 1 Tf
0.6389 0 Td
(2)Tj
/T1_10 1 Tf
0.0004 Tc 4.98129 0 0 4.98129 369.12903 617.48303 Tm
(12)Tj
ET
0.379 w 
346.81 612.91302 m
376.40802 612.91302 l
S
BT
/T1_7 1 Tf
0 Tc 5.9776 0 0 5.9776 354.18549 607.41931 Tm
(256)Tj
/T1_10 1 Tf
4.98129 0 0 4.98129 365.1442 609.13489 Tm
(5)Tj
/T1_5 1 Tf
8.9664 0 0 8.9664 377.60309 610.67139 Tm
(\))Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 381.18689 614.48047 Tm
(m)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 388.22302 610.67139 Tm
[(,)-233(that)-229(is,)-233(the)-229(lik)10(elihood)-228(that)-229(we)-229(happen)-229(to)-228(incor)20(-)]TJ
-7.96429 -1.1667 Td
[(rectly)-287(v)15(erify)]TJ
/T1_4 1 Tf
5.2233 0 Td
(m)Tj
/T1_0 1 Tf
1.1922 0 Td
[(possible)-287(n-grams,)-295(each)-287(represented)-287(by)-287(a)-286(particular)]TJ
-6.4155 -1.1667 Td
(bit)Tj
/T1_4 1 Tf
1.26891 0 Td
(b)Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 332.13879 588.7536 Tm
(i)Tj
/T1_0 1 Tf
-0.00011 Tc 8.9664 0 0 8.9664 335.30051 589.74976 Tm
[(,)-220(out)-213(of)-213(all)-213(possible)-213(n-grams.)-298(This)-213(simpli\223es)-213(to)]TJ
/T1_5 1 Tf
0 Tc 18.62041 0 Td
(\()Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 510.67679 593.4234 Tm
(1)Tj
ET
507.03802 591.992 m
517.96899 591.992 l
S
BT
/T1_7 1 Tf
5.9776 0 0 5.9776 507.0376 586.49756 Tm
(2)Tj
/T1_10 1 Tf
0.0004 Tc 4.98129 0 0 4.98129 510.69049 588.21338 Tm
(12)Tj
/T1_5 1 Tf
0 Tc 8.9664 0 0 8.9664 519.16437 589.74988 Tm
(\))Tj
/T1_8 1 Tf
5.9776 0 0 5.9776 522.74805 593.55902 Tm
(m)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 529.78406 589.74988 Tm
[(,)-220(which)]TJ
-23.7523 -1.1667 Td
[(rapidly)-309(gro)25(ws)-309(smaller)-309(with)-308(increasing)]TJ
/T1_4 1 Tf
15.6282 0 Td
(m)Tj
/T1_0 1 Tf
0.9055 0 Td
[(.)-487(In)-309(our)-308(e)15(xperiments,)-324(we)]TJ
-16.53371 -1.1667 Td
[(found)-381(that)-381(a)-381(similarity)-381(score)-381(threshold)-381(of)-381(0.1)-381(produced)-381(good)-381(re-)]TJ
0 -1.1667 TD
[(sults;)-344(combined)-313(with)-313(the)-313(f)10(act)-313(that)-313(the)-313(a)20(v)15(erage)-313(number)-313(of)-313(n-grams)]TJ
T*
[(in)-250(a)-249(f)10(alse)-250(positi)25(v)15(e)-250(alert)-249(is)-250(approximately)-250(55,)-250(the)-249(probability)-250(of)-250(mis-)]TJ
T*
[(correlating)-374(a)-374(Bloom)-374(\223lter)-374(alert)-374(due)-374(to)]TJ
/T1_3 1 Tf
16.0054 0 Td
(5)Tj
/T1_0 1 Tf
0.8741 0 Td
[(unluck)15(y)-374(coincidences)-374(is)]TJ
/T1_5 1 Tf
-16.8795 -1.1667 Td
(\()Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 325.23029 530.65881 Tm
(1)Tj
ET
321.591 529.22705 m
332.522 529.22705 l
S
BT
/T1_7 1 Tf
5.9776 0 0 5.9776 321.59119 523.73303 Tm
(2)Tj
/T1_10 1 Tf
0.0004 Tc 4.98129 0 0 4.98129 325.24402 525.44891 Tm
(12)Tj
/T1_5 1 Tf
0 Tc 8.9664 0 0 8.9664 333.71802 526.98517 Tm
(\))Tj
/T1_7 1 Tf
5.9776 0 0 5.9776 337.30179 530.79419 Tm
(5)Tj
/T1_0 1 Tf
8.9664 0 0 8.9664 341.45279 526.98517 Tm
[(\204not)-350(a)-351(major)-351(concern.)-611(In)-350(short,)-375(testing)-350(multiple)-351(n-grams)]TJ
-2.74809 -1.1667 Td
[(eliminates)-338(coincidences)-339(v)15(ery)-338(rapidly)65(.)-575(Sizing)-339(the)-338(Bloom)-338(\223lter)-339(ap-)]TJ
T*
[(propriately)-250(to)-250(a)20(v)20(oid)-250(saturation)-250(is)-250(a)-250(f)10(ar)-250(more)-250(important)-250(issue.)]TJ
1 -1.1667 Td
[(Gi)25(v)15(en)-374(the)-375(ef)25(fecti)25(v)15(eness)-374(of)-374(n-gram)-375(analysis,)-405(combined)-374(with)-375(its)]TJ
-1 -1.1667 Td
[(strong)-400(pri)25(v)25(ac)15(y)-400(guarantees)-401(and)-400(compact)-400(size,)-438(we)-400(belie)25(v)15(e)-400(there)-401(is)]TJ
T*
[(great)-250(promise)-250(for)-250(this)-250(form)-250(of)-250(payload-based)-250(correlation.)]TJ
/T1_2 1 Tf
11.9552 0 0 11.9552 316.81189 449.7865 Tm
[(5.)-1000(RELA)95(TED)-250(W)10(ORK)]TJ
/T1_0 1 Tf
8.9664 0 0 8.9664 325.77829 436.83508 Tm
[(W)80(e)-223(discuss)-224(selected)-223(related)-223(w)10(ork)-224(from)-223(a)-224(number)-223(of)-223(dif)25(ferent)-224(net-)]TJ
-1 -1.1667 Td
[(w)10(ork)-245(security)-245(and)-245(intrusion-detection)-245(areas,)-246(and)-244(encourage)-245(readers)]TJ
T*
[(to)-249(see)-249(the)-249(related)-249(w)10(ork)-249(sections)-249(of)-249([46,)-249(44,)-249(45])-249(for)-249(a)-249(full)-249(discussion)]TJ
T*
[(on)-266(netw)10(ork)-266(anomaly)-265(detection,)-270(frequenc)15(y)-266(and)-266(n-gram)-265(analysis.)-358(T)80(o)]TJ
T*
[(the)-237(best)-238(of)-237(our)-237(kno)25(wledge,)-240(there)-238(does)-237(not)-237(e)15(xist)-238(a)-237(collection)-237(of)-238(tech-)]TJ
T*
[(niques)-250(nor)-250(an)-250(e)25(v)25(aluation)-250(similar)-250(in)-250(scope)-250(to)-250(this)-250(paper)55(.)]TJ
/T1_2 1 Tf
1 -1.1667 Td
[(Distrib)20(uted)-390(intrusion)-390(detection.)]TJ
/T1_0 1 Tf
14.4075 0 Td
[(Distrib)20(uted)-390(intrusion)-390(detec-)]TJ
-15.4075 -1.1667 Td
[(tion)-227(has)-226(been)-227(researched)-227(for)-226(o)15(v)15(er)-227(10)-227(years;)-234(most)-227(research,)-231(e.g.,)-232([35,)]TJ
T*
[(32,)-277(23])-271(has)-272(focused)-271(on)-271(distrib)20(ution)]TJ
/T1_3 1 Tf
14.25169 0 Td
(within)Tj
/T1_0 1 Tf
…

0 g
1 i 
/RelativeColorimetric ri
/GS0 gs
BT
/T1_0 1 Tf
0 Tc 0 Tw 0  Ts 100  Tz 0 Tr 8.9664 0 0 8.9664 53.79829 728.23907 Tm
[(A)92(w)10(are)-318(Distrib)20(ution)-318(Signatures\216,)-336(seek)-318(to)-318(blend)-318(frequenc)15(y)-319(distrib)20(u-)]TJ
0 -1.1667 TD
[(tions)-250(and)-250(pack)10(et)-250(signature)-250(positioning.)]TJ
1 -1.1667 Td
[(More)-263(recently)65(,)-267(w)10(ork)-263(has)-263(focused)-263(on)-263(b)20(uilding)]TJ
/T1_1 1 Tf
18.2195 0 Td
[(semantic-awar)37(e)]TJ
/T1_0 1 Tf
6.61411 0 Td
(or)Tj
/T1_1 1 Tf
-25.8336 -1.1667 Td
[(vulner)15(ability)]TJ
/T1_0 1 Tf
5.0959 0 Td
[(-based)-253(signatures)-253(to)-253(handle)-253(multiple)-253(\(or)-253(polymorphic\))]TJ
-5.0959 -1.1667 Td
[(attacks)-364(for)-364(the)-365(same)-364(e)15(xploit.)-653(Krue)15(gel)-364(et.)-653(al.)-652([22])-364(use)-365(structural)]TJ
T*
[(analysis)-318(of)-319(binary)-318(code)-318(and)-319(generate)-319(control-\224o)25(w)-318(graphs)-318(to)-319(catch)]TJ
T*
[(w)10(orm)-398(mutations.)-752(Shield)-398([42])-398(pro)15(vides)-397(vulnerability-speci\223c)-398(b)20(ut)]TJ
T*
[(e)15(xploit-generic)-258(\223lters)-258(based)-258(on)-258(prede\223ned)-258(protocol-based)-258(policies.)]TJ
T*
[(V)60(igilante)-406([8])-406(introduces)-405(the)-406(notion)-406(of)-406(vulnerability-speci\223c)]TJ
/T1_1 1 Tf
24.9446 0 Td
(self-)Tj
-24.9446 -1.1667 Td
[(certifying)-310(alerts)]TJ
/T1_0 1 Tf
6.7303 0 Td
[(that)-310(focus)-309(on)-310(\223ltering)-310(undesirable)-310(e)15(x)15(ecution)-309(con-)]TJ
-6.7303 -1.1667 Td
[(trol,)-273(code)-269(e)15(x)15(ecution,)-273(or)-268(function)-269(ar)18(guments,)-273(and)-269(can)-268(be)-269(e)15(xchanged)]TJ
T*
[(via)-407(P2P)-408(systems.)-782(VSEF)-407([29])-408(b)20(uilds)]TJ
/T1_1 1 Tf
15.6059 0 Td
[(e)20(xecution-based)-407(\223lter)10(s)]TJ
/T1_0 1 Tf
9.5607 0 Td
(that)Tj
-25.1666 -1.1667 Td
[(\223lter)-315(out)-315(vulnerable)-316(processor)-315(instruction-based)-315(traces.)-506(CO)50(VERS)]TJ
T*
[([24])-283(analyzes)-283(attack-triggered)-283(memory)-283(errors)-283(on)-283(a)-284(host)-284(and)-283(de)25(v)15(el-)]TJ
T*
[(ops)-262(structural)-263(memory)-262(signatures.)-347(Nemean)-263([50])-262(uses)-263(session-layer)]TJ
T*
[(and)-249(application-protocol)-249(semantics)-249(to)-249(reduce)-249(f)10(alse)-249(positi)25(v)15(es.)-310(Some)]TJ
T*
[(of)-249(these)-249(signatures)-250(and)-249(\223lter)-249(descriptions)-249(may)-249(be)-250(e)15(xchangeable)-250(us-)]TJ
T*
[(ing)-250(our)-250(techniques.)]TJ
/T1_2 1 Tf
1 -1.1667 Td
[(Pri)10(v)10(acy-pr)18(eser)10(ving)-304(collaboration.)]TJ
/T1_0 1 Tf
14.81059 0 Td
[(Lincoln)-304(et)-304(al.)-473([25])-304(suggest)]TJ
-15.81059 -1.1667 Td
[(hash-based)-318(sanitization)-318(of)-318(se)25(v)15(eral)-317(header)-318(\223elds,)-334(enabling)-318(equality)]TJ
T*
[(matching)-417(\(e.g.,)-459(identifying)-418(the)-417(same)-417(source)-417(IP\))-417(while)-418(remo)15(ving)]TJ
T*
[(other)-408(features,)-448(including)-408(payloads;)-487(instead,)-448(our)-408(techniques)-408(k)10(eep)]TJ
T*
[(\(and)-275(analyze\))-276(these)-275(payloads.)-387(Kissner)-275([19])-275(describes)-276(the)-275(notion)-276(of)]TJ
T*
[(pri)25(v)25(ac)15(y-preserving)-331(set)-330(operations)-331(using)-331(cryptographic)-331(techniques,)]TJ
T*
[(achie)25(ving)-294(stronger)-293(pri)25(v)25(ac)15(y)-294(guarantees.)-441(While)-293(it)-294(is)-294(restricted)-294(to)-294(set)]TJ
T*
[(union,)-211(intersection,)-211(etc.,)-211(it)-202(may)-201(potentially)-202(support)-201(n-gram)-202(analysis.)]TJ
/T1_1 1 Tf
T*
[(Privacy-Pr)37(eserving)-238(F)55(riends)-239(T)55(r)45(oubleshooting)-239(Network)]TJ
/T1_0 1 Tf
21.72211 0 Td
[([16])-239(e)15(xtends)]TJ
-21.72211 -1.1667 Td
[(earlier)-215(w)10(ork)-215(on)-215(PeerPressure)-215([43]\204collaborati)25(v)15(e)-215(softw)10(are)-215(con\223gu-)]TJ
T*
[(ration)-225(diagnosis\204with)-224(a)-225(pri)25(v)25(ac)15(y-preserving)-224(architecture)-225(utilizing)-225(a)]TJ
T*
[(\215friend\216-based)-212(neighbor)-211(approach,)-220(including)-212(the)-211(use)-212(of)-212(secure)-212(mul-)]TJ
T*
[(tiparty)-200(computation)-199(to)-200(v)20(ote)-199(on)-200(con\223guration)-200(outliers)-200(and)-200(homomor)20(-)]TJ
T*
[(phic)-225(encryption)-225(to)-226(protect)-225(pri)25(v)25(ac)15(y)65(.)-302(Xu)-225([47])-225(introduces)-225(the)-225(notion)-226(of)]TJ
T*
[(\215concept)-213(hierarchies\216)-213(to)-213(abstract)-213(lo)25(w-le)25(v)15(el)-213(concepts,)-221(along)-213(with)-213(the)]TJ
-0.00011 Tc T*
[(use)-288(of)-288(entrop)10(y)65(,)-298(to)-288(balance)-288(the)-288(sanitization)-288(and)-288(information)-288(gain)-288(of)]TJ
0 Tc T*
[(alerts;)-368(a)-330(similar)-329(use)-330(of)-329(entrop)10(y)-329(may)-329(also)-329(be)-329(applicable)-329(here.)-547(The)]TJ
T*
[(J)60(AM)-234(project)-234(in)-235(our)-234(research)-234(group)-234([38])-235(w)10(as)-234(an)-234(early)-234(inspiration)-235(for)]TJ
T*
[(this)-224(w)10(ork;)-232(it)-224(originally)-223(look)10(ed)-224(at)-224(abstracting)-223(and)-224(comparing)-224(models)]TJ
T*
[(of)-267(data)-267(for)-267(bank)-267(fraud)-267(to)-267(enable)-267(competing)-267(\223nancial)-267(institutions)-267(to)]TJ
T*
[(collaborate)-279(in)-279(catching)-279(criminals)-279(without)-279(releasing)-279(sensiti)25(v)15(e)-279(infor)20(-)]TJ
T*
[(mation.)-367(This)-269(w)10(ork,)-273(on)-269(the)-269(other)-269(hand,)-274(focuses)-269(on)-269(the)-269(v)25(alidation)-269(of)]TJ
T*
[(byte)-267(content)-267(detected)-267(at)-267(multiple)-267(sites)-267(as)-267(indicators)-267(of)-267(common)-267(at-)]TJ
T*
[(tack)-242(information;)-245(the)-243(J)60(AM)-242(w)10(ork)-242(more)-243(closely)-242(resembles)-242(BF)-243(model)]TJ
T*
[(intersection,)-250(which)-250(we)-250(brie\224y)-250(discuss)-250(in)-250(section)-250(6.)]TJ
/T1_2 1 Tf
1 -1.1667 Td
[(Pri)10(v)10(acy-pr)18(eser)10(ving)-216(databases)-217(and)-217(data)-216(mining)15(.)]TJ
/T1_0 1 Tf
20.1859 0 Td
[(There)-217(is)-216(a)-217(tre-)]TJ
-21.1859 -1.1667 Td
[(mendous)-361(v)20(olume)-362(of)-361(w)10(ork)-361(on)-362(v)25(arious)-361(aspects)-362(of)-361(data)-361(mining)-362(and)]TJ
T*
[(databases,)-372(e.g.)-604([1];)-397(these)-348(primarily)-348(w)10(ork)-348(of)25(\224ine,)-372(and)-348(assume)-348(se-)]TJ
-0.00011 Tc T*
[(cure)-327(querying,)-347(perturbation,)-346(and)-327(aggre)15(gate)-327(computation)-328(of)-327(v)25(alues)]TJ
0 Tc T*
[(amongst)-360(one)-360(or)-360(tw)10(o)-360(databases,)-387(and)-360(do)-360(not)-360(generally)-360(scale)-360(to)-360(the)]TJ
T*
[(run-time)-250(correlation)-250(described)-250(here.)]TJ
/T1_2 1 Tf
1 -1.1667 Td
[(Bloom)-345(\223lters.)]TJ
/T1_0 1 Tf
6.4137 0 Td
[(Bloom)-345(\223lters)-346(ha)20(v)15(e)-345(been)-346(used)-345(for)-346(secure)-345(inde)15(x-)]TJ
-7.4137 -1.1667 Td
[(ing)-349(and)-349(data)-349(e)15(xchange)-349([4,)-374(3,)-374(14];)-398(most)-350(focus)-349(on)-349(tw)10(o-party)-349(inter)20(-)]TJ
T*
[(action)-297(and)-297(precisely-de\223ned)-296(entities.)-451([12,)-308(6])-297(use)-297(Bloom)-297(\223lters)-297(for)]TJ
T*
[(hardw)10(are-based)-250(pack)10(et)-250(inspection)-250(and)-250(classi\223cation.)]TJ
/T1_2 1 Tf
1 -1.1667 Td
[(Secur)18(e)-305(multiparty)-304(computation)-305(\(SMC\))]TJ
/T1_0 1 Tf
16.97659 0 Td
[([48])-305(is)-304(a)-305(theoretically)]TJ
-17.97659 -1.1667 Td
[(attracti)25(v)15(e)-197(w)10(ay)-196(to)-197(accomplish)-197(pri)25(v)25(ac)15(y-preserv)25(ation,)-207(e.g.,)-208(intersection)]TJ
T*
[(can)-289(be)-290(f)10(ashioned)-289(as)-290(a)-289(secure)-289(computation)-290(problem.)-428(Du)-289(et)-290(al.)-429([13])]TJ
T*
[(brie\224y)-294(re)25(vie)25(ws)-293(the)-294(possibility)-294(of)-294(sharing)-293(intrusion)-294(detection)-294(infor)20(-)]TJ
T*
[(mation)-196(via)-196(SMC;)-196(ho)25(we)25(v)15(er)40(,)-207(algorithmic)-196(cost)-196(remains)-196(a)-197(concern)-196([25],)]TJ
T*
[(especially)-250(with)-250(lar)18(ge)-250(alert)-250(streams.)]TJ
/T1_2 1 Tf
11.9552 0 0 11.9552 53.7982 98.10139 Tm
[(6.)-1000(FUTURE)-250(W)10(ORK)]TJ
8.9664 0 0 8.9664 62.7646 85.15001 Tm
[(W)18(ide-scale)-346(deployment,)-371(cr)18(oss-site)-346(e)15(v)10(aluation.)]TJ
/T1_0 1 Tf
20.1553 0 Td
[(These)-346(techni-)]TJ
-21.1553 -1.1667 Td
[(ques)-301(are)-301(speci\223cally)-301(designed)-301(to)-301(be)-301(deplo)10(yed)-301(at)-301(man)15(y)-301(encla)20(v)15(es)-301(to)]TJ
29.3333 72.8887 Td
[(increase)-263(the)-263(correlation)-262(po)25(wer)-263(and)-263(con\223dence)-263(pro)15(vided)-263(by)-263(sensors)]TJ
T*
[(at)-253(dif)25(ferent)-253(sites)-253(with)-253(dif)25(ferent)-253(content)-253(\224o)25(ws.)-319(Our)]TJ
/T1_1 1 Tf
20.0938 0 Td
[(W)92(orminator)]TJ
/T1_0 1 Tf
5.07291 0 Td
(dis-)Tj
-25.1666 -1.1667 Td
[(trib)20(uted)-243(collaborati)25(v)15(e)-243(intrusion)-243(detection)-243(platform)-243([37,)-245(26])-243(focused)]TJ
-0.00011 Tc T*
[(on)-213(slo)25(w)65(,)-220(stealthy)-212(alert)-213(scan)-213(correlation)-212(with)-213(CO)40(TS)-213(IDS)-212(sensors.)-298(W)80(e)]TJ
0 Tc T*
[(are)-255(inte)15(grating)-254(the)-255(w)10(ork)-255(reported)-254(in)-255(this)-254(paper)-255(with)-255(a)-254(ne)25(w)-255(and)-255(sub-)]TJ
T*
[(stantially)-211(dif)25(ferent)-212(content)-211(e)15(xchange)-212(and)-211(sharing)-212(netw)10(ork)-211(kno)25(wn)-212(as)]TJ
T*
[(DN)35(AD-2)-280(\(Distrib)20(uted)-280(Netw)10(ork)-280(Anomaly)-280(Detection\))-280(and)-280(seek)-280(col-)]TJ
T*
[(laborators)-311(to)-311(share)-312(their)-311(respecti)25(v)15(e)-311(suspicious)-311(content)-311(detected)-312(by)]TJ
T*
[(whate)25(v)15(er)-250(local)-250(sensors)-250(may)-250(be)-250(a)20(v)25(ailable)-250(to)-250(them.)]TJ
/T1_2 1 Tf
1 -1.1667 Td
[(P)20(olymor)10(phic/obfuscated)-190(w)10(orm)-190(detection)-190(and)-190(mimicry)-190(attack.)]TJ
/T1_0 1 Tf
-1 -1.1667 Td
[(As)-250(suggested)-251(by)-250(section)-250(4,)-251(n-gram)-250(analysis)-250(has)-251(the)-250(potential)-250(of)-251(de-)]TJ
T*
[(tecting)-207(polymorphic)-208(w)10(orms,)-216(e.g.,)-216([11].)-296(While)-207(the)-207(problem)-208(becomes)]TJ
T*
[(signi\223cantly)-272(harder)-272(as)-271(polymorphic)-272(w)10(orm)-272(engines)-272(launch)]TJ
/T1_1 1 Tf
23.38969 0 Td
(mimicry)Tj
-23.38969 -1.1667 Td
[(attac)20(ks)]TJ
/T1_0 1 Tf
3.228 0 Td
[([41,)-456(20])-415(to)-415(mask)-415(themselv)15(es,)-457(such)-415(attacks)-415(are)-415(generally)]TJ
-3.228 -1.1667 Td
[(site-speci\223c.)-833(Intersecting)-425(n-gram)-424(BFs)-424(across)-425(sites)-424(may)-425(pro)15(vide)]TJ
T*
[(the)-386(opportunity)-385(to)-386(identify)-385(e)25(v)15(en)-386(the)-385(fe)25(w)-386(bytes)-386(of)-385(in)40(v)25(ariant)-386(com-)]TJ
T*
[(mon)-354(\215code\216)-355(that)-354(appear)-355(an)15(ywhere)-354(in)-355(such)-354(attacks.)-623(Ha)20(ving)-355(more)]TJ
T*
[(BFs)-274(that)-274(can)-274(correlate)-274(these)-274(short)-274(re)15(gions)-274(increases)-274(the)-274(con\223dence)]TJ
T*
[(in)-229(ha)20(ving)-229(found)-229(the)-229(correct)-229(snippets.)]TJ
/T1_1 1 Tf
14.78729 0 Td
[(High-entr)45(opy)]TJ
/T1_0 1 Tf
5.57201 0 Td
[(re)15(gions,)-233(such)-229(as)]TJ
-20.3593 -1.1667 Td
[(those)-235(containing)-235(polymorphic)-235(or)-235(obfuscated)-235(code,)-238(w)10(ould)-236(lik)10(ely)-235(not)]TJ
T*
[(be)-250(correlated.)]TJ
/T1_2 1 Tf
1 -1.1667 Td
[(Pri)10(v)10(acy-pr)18(eser)10(ving)-305(model)-304(corr)18(elation.)]TJ
/T1_0 1 Tf
16.7645 0 Td
[(Gi)25(v)15(en)-305(dif)25(ferent)-304(site)-305(a-)]TJ
-17.7645 -1.1667 Td
[(nomaly)-190(models,)-202(e.g.,)-202(tw)10(o)-190(Bloom)-190(\223lters)-190(that)-190(represent)-190(anomaly)-190(mod-)]TJ
T*
[(els)-216(for)-217(Anagram,)-223(we)-216(can)-217(do)-216(a)-216(bitwise)-217(AND)-216(of)-217(the)-216(tw)10(o)-216(Bloom)-217(\223lters)]TJ
T*
[(to)-334(estimate)-335(the)-334(number)-334(of)-335(common)-334(\215good\216)-335(n-grams,)-356(or)-334(a)-335(bitwise)]TJ
-0.00011 Tc T*
[(OR)-249(of)-249(the)-249(tw)10(o)-250(Bloom)-249(\223lters)-249(to)-249(aggre)15(gate)-249(and)-249(update)-250(the)-249(respecti)25(v)15(e)]TJ
0 Tc T*
[(models.)-445(Further)-295(discussion)-295(of)-295(this)-295(concept)-295(is)-295(be)15(yond)-296(the)-295(scope)-295(of)]TJ
T*
[(this)-205(paper;)-219(see)-205([15,)-213(9])-205(for)-204(an)-205(application)-205(of)-204(this)-205(approach)-204(to)-205(enhance)]TJ
T*
[(access)-250(control.)]TJ
/T1_2 1 Tf
11.9552 0 0 11.9552 316.81201 411.42609 Tm
[(7.)-1000(CONCLUSION)]TJ
/T1_0 1 Tf
8.9664 0 0 8.9664 325.77838 398.47458 Tm
[(W)80(e)-232(ha)20(v)15(e)-233(presented)-232(a)-233(vie)25(w)-232(of)-233(cross-site)-233(and)-232(cross-domain)-233(collab-)]TJ
-1 -1.1666 Td
[(orati)25(v)15(e)-207(security)-206(by)-207(w)10(ay)-207(of)-207(sharing)-207(content-based)-207(alerts)-207(among)-207(sites.)]TJ
0 -1.1666 TD
[(It)-338(is)-338(to)-338(e)25(v)15(eryone\220)55(s)-338(bene\223t)-338(to)-338(share)-338(important)-338(information)-338(without)]TJ
T*
[(violating)-257(policies)-256(that)-257(inhibit)-256(the)-257(disclosure)-257(of)-256(information.)-330(In)-257(par)20(-)]TJ
T*
[(ticular)40(,)-409(content-based)-378(alerts)-377(generated)-378(by)-377(locally-trained)-378(payload)]TJ
T*
[(anomaly)-301(detectors)-302(re)25(v)15(eals)-301(an)-301(opportunity)-301(to)-302(detect)-301(the)-301(early)-302(onset)]TJ
T*
[(of)-264(zero-day)-264(w)10(orm)-264(or)-264(tar)18(geted)-263(attacks.)-352(W)80(e)-264(presented)-264(a)-264(comparati)25(v)15(e)]TJ
T*
[(e)25(v)25(aluation)-352(of)-351(alternati)25(v)15(e)-352(correlation)-352(strate)15(gies)-351(and)-352(accurac)15(y)-352(mea-)]TJ
T*
[(sures)-214(using)-213(test)-214(data)-214(sets)-213(with)-214(kno)25(wn)-214(w)10(orm)-213(e)15(xploits,)-221(and)-214(included)-214(a)]TJ
-0.00011 Tc T*
[(proposed)-259(estimate)-259(of)-258(the)-259(\215pri)25(v)25(ac)15(y)-259(gain\216)-259(each)-259(method)-259(af)25(fords.)-337(This)]TJ
0 Tc T*
[(is)-389(important)-389(in)-390(approaching)-389(the)-389(problem)-389(analytically)-389(in)-389(order)-390(to)]TJ
T*
[(help)-315(break)-315(do)25(wn)-315(barriers)-316(to)-315(collaboration.)-505(W)80(e)-315(\223nd)-316(that)-315(cross-site)]TJ
T*
[(and)-265(cross-domain)-266(pri)25(v)25(ac)15(y-preserving)-265(\215suspect)-266(payload\216)-265(alert)-266(shar)20(-)]TJ
T*
[(ing)-214(is)-213(feasible)-214(and)-214(useful)-213(as)-214(re)25(v)15(ealed)-213(in)-214(the)-214(analysis)-213(of)-214(Bloom)-214(\223lter)20(-)]TJ
T*
[(e)15(xchanged)-250(alerts)-250(encoding)-250(suspect)-250(anomalous)-250(n-grams.)]TJ
1 -1.1667 Td
[(The)-393(techniques)-392(hold)-393(promise)-393(for)-392(other)-393(purposes)-393(as)-393(well.)-738(F)15(or)]TJ
-1 -1.1667 Td
[(e)15(xample,)-435(sites)-399(may)-398(e)15(xchange)-399(their)-398(respecti)25(v)15(e)-398(anomaly)-399(detection)]TJ
0 -1.1667 TD
[(models)-401(to)-402(measure)-401(their)-401(respecti)25(v)15(e)-402(\215content)-401(\224o)25(w)-401(di)25(v)15(ersity\216,)-440(en-)]TJ
T*
[(abling)-332(estimation)-332(of)-332(the)-331(relati)25(v)15(e)-332(v)25(alue)-331(of)-332(dif)25(ferent)-331(anomaly)-332(alerts)]TJ
T*
[(generated)-290(by)-290(dif)25(ferent)-289(sites.)-430(More)-290(similar)-289(sites)-290(may)-290(ha)20(v)15(e)-290(a)-290(higher)]TJ
T*
[(chance)-301(of)-301(detecting)-302(common)-301(e)15(xploits.)-464(Finally)65(,)-314(pri)25(v)25(ac)15(y-preserving)]TJ
T*
[(content)-310(alerts)-309(may)-310(also)-310(be)-310(useful)-310(for)-310(other)-310(problems,)-324(such)-310(as)-310(col-)]TJ
T*
[(laborati)25(v)15(e)-386(spam)-386(\223ltering,)-420(suspicious)-386(content)-386(detection)-387(for)-386(botnet)]TJ
T*
[(command-and-control)-250(data)-250(streams,)-250(etc.)]TJ
/T1_2 1 Tf
11.9552 0 0 11.9552 316.81201 133.9664 Tm
[(8.)-1000(A)55(CKNO)50(WLEDGMENTS)]TJ
/T1_0 1 Tf
7.97009 0 0 7.97009 325.77838 122.5094 Tm
[(W)80(e)-462(w)10(ould)-462(lik)10(e)-462(to)-462(thank)-463(Gabriela)-462(Cretu,)-515(W)80(ei-Jen)-462(Li,)-515(V)111(anessa)-462(Frias-)]TJ
-1.125 -1.125 Td
[(Martinez,)-340(Michael)-323(Locasto,)-340(Angelos)-323(Sta)20(vrou,)-340(and)-322(Angelos)-323(K)25(eromytis)-322(for)]TJ
0 -1.125 TD
[(their)-222(feedback)-222(and)-222(collaboration)-222(on)-223(our)-222(design.)-300(W)80(e)-223(w)10(ould)-222(also)-222(lik)10(e)-222(to)-222(thank)]TJ
T*
[(P)15(anagiotis)-263(Manolios)-262(and)-263(Peter)-262(Dillinger)-263(for)-263(their)-262(suggestions)-263(in)-262(Bloom)-263(\223l-)]TJ
T*
[(ter)-261(design.)-344(This)-262(w)10(ork)-261(w)10(as)-262(partially)-261(sponsored)-261(under)-262(a)-261(grant)-261(with)-262(the)-261(Army)]TJ
T*
[(Research)-250(Of)25(\223ce,)-250(No.)-310(D)40(A)-250(W911NF-04-1-0442.)]TJ
ET
q
/RelativeColorimetric ri
/GS1 gs
/Fm0 Do
Q