Collaborative Network Defense with Minimum Disclosure

Collaboration of defensive network components of multiple operators is a promising approach for increasing anomaly detection accuracy. This concept involves sharing of possibly sensitive data, hence privacy preservation has to be taken into account. In this paper, we argue that common approaches for sharing traffic information often impede proper analysis due to privacy-preserving mangling operations, and ignore the opportunity to exploit additional knowledge of the originating network operator for interpreting the monitored data. We propose COMINDIS, a lightweight framework for sharing notions of suspiciousness among network operators, and show how to exploit different detection systems for deriving a better understanding of Internet hosts' activities. We evaluate the system both by using a network emulator and by experimenting with a real traffic trace.