Bernhard Tellenbach

The home page of my one-man business is located at www.it-beratung-tellenbach.ch

I am a member of the board of the Information Security Society Switzerland (ISSS)

Research Interests

Primary Interests

• Large scale traffic measurements and traffic characterization in the backbone
• Automated attack detection and signature generation methods

Other Interests

• Network Security (network traffic analysis, network based IDS/IPS, ...)
• System Security (honeypots, host based IDS/IPS, security architectures, ...)
• Operating System Concepts

Projects

• NoAH - An European Network of Affined Honeypots
• CSG Computer Cluster for Netflow Data Collection and Processing (cluster structure).

Conference and Workshop Papers

• Beyond Shannon: Characterizing Internet Traffic with Generalized Entropy Metrics
  Bernhard Tellenbach, Martin Burkhart, Didier Sornette and Thomas Maillart
  Passive and Active Measurement Conference, PAM 2009, Seoul, South-Korea
• Rating Autonomous Systems
  Laurent Zimmerli, Bernhard Tellenbach, Arno Wagner and Bernhard Plattner
  IEEE International Conference on Internet Monitoring and Protection, ICIMP 2009, Venice, Italy
• Impact of Traffic Mix and Packet Sampling on Anomaly Visibility
  Bernhard Tellenbach, Daniela Brauckhoff and Martin May
  IEEE International Conference on Internet Monitoring and Protection, ICIMP 2008, Bucharest, Romania, best paper award
• 0-Day Patch - Exposing vendors (in)security performance
  Stefan Frei, Bernhard Tellenbach
  BlackHat Europe 2008, Amserdam, March, 2008 [pdf]
• The NoAH Project - Poster
  S. Antonatos, D. Brauckhof, B. Tellenbach, A. Slowinska
  TNC 2007, Copenhagen, 20-24 May 2007
• Impact of Packet Sampling on Anomaly Detection Metrics
  Daniela Brauckhoff, Bernhard Tellenbach, Arno Wagner, Anukool Lakhina, Martin May
  ACM Internet Measurement Conference 2006, IMC 2006, Rio de Janeiro, Brazil, October, 2006.

Technical Reports

• Impact of Traffic Mix and Packet Sampling on Anomaly Visibility
  Bernhard Tellenbach, Daniela Brauckhoff, Martin May
  ETH Zurich, TIK Report Nr. 275, June, 2007
• A Survey on Automated Signature Generation Approaches
  Bernhard Tellenbach, Daniela Brauckhoff, Bernhard Plattner
  ETH Zurich, TIK Report Nr. 258, February, 2006

In the Press

• BlackHat 2008 presentation related (selection):
  Apple Crumble @ BlackHat, on Frequency X blog, IBM Internet Security Systems
  Black Hat: new operating systems security metric, on Heise Security (german and english)
  Informatiker entzaubern Apple - Microsoft flickt fixer (german)
• Computernetzwerke gegen unbekannte Angriffe Schützen (German) (won the ITG award for specialiced literature 2009)
  Engl. title: ProEU Project NoAH: Early Warning and Containment for new Cyberattacks
  Bernhard Tellenbach, Daniela Brauckhoff, Bernhard Plattner
  To appear in SEV-Bulletin, March 2008
• Mit Honig gegen Hacker
  Fighting Hackers with Honey
  ETH Globe, Special issue on Risk and Security, November, 2007
• EU-Projekt NoAH zur Früherkennung und Bekämpfung von neuen Cyberattacken
  EU Project NoAH: Early Warning and Containment of new Cyberattacks
  Bernhard Tellenbach
  Security Zone Newsletter, March 2006

Teaching Activities

• Operating Systems I&II (lecturer) at the University of applied science Rapperswil (HSR)
• Computer Engineering 2 (part of the lab and exam staff) since SS2005
• Network Security (lecture and lab co-ordinator) from WS2005/06 to WS2007/08
• Lead of the Communication Networks/Network Security student lab infrastructure renewal project in 2006 (HW&SW)

Supervised Student Theses

Offered Student Theses

Check the student thesis announcement page of TIK

Ongoing Student Theses

Internal:

• Evaluating and improving TES II (SA-2009-17) [David Gugelmann] [report]

External:

• At OPEN SYSTEMS: Event Correlation Engine (MA-2009-01) [Andreas Müller] [report]
• At HSR: Software zur Identifikation von Applikationsklassen in NetFlow-Daten (GA-2009-03) [Selim Akyol, Edon Berisha] [report]

Past Student Theses (internal)

• Evaluating and improving the TES (MA-2008-28) [Tonio Gsell] [report]
• Towards Application/Anomaly Detection and Modelling using Network Traces (MA-2007-43) [Gabriel Mueller] [report]
• Towards Towards Automated Exploit Signature Generation using Honeypots (MA-2007-09) [Pascal Gamper][report]
• Towards Analyzing network traffic from the SWITCH network from 2003 until today (MA-2007-09) [Dominik Schatzmann][report]
• Towards Application Detection and Modelling using Network Traces (MA-2007-09) [Daniel Koller][report]
• Towards Exploit Signature Generation using Honeypots II (MA-2007-09) [Marcel Marghitola][report]
• Towards Exploit Signature Generation using Honeypots (SA-2006-20) [D. Langenegger, P. Bichsel][report]
• Entropy-Plugin and Visualisation Tool (SA-2006-25)[Stefan Keller][report]
• Attack Detection and Automated Attack Signature Generation using Honeypots (SA-2006-21) [Nicoletta De Maio][report]
• BlueLocator II (SA-2006-03)[Oliver Keiser and Philipp Sommer][report]
• Automatic Attack Signature Generation (SA-2005-38) [Rashid Waraich][report]

Past Student Theses (external)

• At OPEN SYSTEMS: Signature-based Extrusion Detection (MA-2008-06) [Cécile Lüssi][report]
• At OPEN SYSTEMS: Rating Autonomous Systems (MA-2008-06) [Laurent Zimmerli][report]
• At GOOGLE: Automatic cryptographic key extraction from arbitrary binaries and decryption of binary input
  (MA-2008-08) [Noé Lutz][report]
• At HSR (University of applied science Rapperswil):
  Software Package for Modular Netflow v5/v9 Data Analysis (HSR_2008_1) [Raphael Rotondari, Sascha Waser][report]
• At HSR (University of applied science Rapperswil):
  Visualization Toolkit for Long Term (Netflow) Time Series Analysis (HSR_2008_2) [Stefan Guidon][report]
• At IBM: Traffic Theft and Misuse Protection for Anonymous Credentials (MA-2007-42) [Patrik Bichsel][report]
• At HSR (University of applied science Rapperswil): Software Package for Netflow v9 Data Analysis (HSR_2007_1) [Loris Siegenthaler, David Benninger][report]
• At OPEN SYSTEMS: Traffic Anomaly Detection on a VPN Gateway (MA-2006-11) [Janet Malibago][report]