Mark Allman, Christian Kreibich, Vern Paxson, Robin Sommer, Nicholas Weaver. Principles for Developing Comprehensive Network Visibility. USENIX Workshop on Hot Topics in Security, July 2008.
PDF

Abstract:

We argue that for both defending against attacks and apprehending the scope of attacks after they are detected, there is great utility in attaining views of network activity that are unified across time and space. By this we mean enabling operators to apply particular analyses to both past and future activity in a coherent fashion, and applied across a wealth of information collected from a variety of monitoring points, including across administratively independent sites. We outline the core design goals necessary for building systems to develop such visibility in an operationally viable way.

BibTeX:

@inproceedings{AKP+08,
    author    =        "Mark Allman and Christian Kreibich and Vern Paxson and Robin Sommer and Nicholas Weaver",
    title     =        "{Principles for Developing Comprehensive Network Visibility}",
    booktitle =        "USENIX Workshop on Hot Topics in Security (HotSec)",
    year      =        2008,
    month     =        jul,
}