Effective Countermeasures Against Emerging Threats in the Future Internet Salvatore D’Antonio Consorzio Interuniversitario Nazionale per l’Informatica Canada-EU Future Internet Workshop March 23-24, 2011 – Waterloo, Canada

EC Grant Agreement n Project overview –IN-TE-R-SE-C-T-I-O-N : INfrastructure for heTErogeneous, Resilient, SEcure, Complex, Tightly Inter-Operating Networks –ICT Call 1 of Seventh Framework Programme (FP7) –Work programme topic addressed Challenge 1: Pervasive and Trusted Network and Service Infrastructures Objective ICT : Secure, dependable and trusted infrastructures –Start date: January 1st, 2008 –Duration: 24 months

EC Grant Agreement n Security and resilience in network infrastructures –Design of scalable, secure and resilient network architectures in order to enable dynamic management policies ensuring end–to-end secure data transmission and service provisioning across heterogeneous infrastructures and networks; real time detection and recovery capabilities against intrusions, malfunctions and failures Trusted computing infrastructures –Design of computing infrastructures enabling interoperability and end-to-end security in order to ensure the design and development of trustworthy applications and services Context

EC Grant Agreement n The Consortium ACADEMY Consorzio Interuniversitario Nazionale per l’Informatica [Italy] Lancaster University [UK] Fraunhofer Gesellschaft Zur Foerderung Der Angewandten Forschung [Germany] Eidgenoessische Technische Hochschule Zuerich [Switzerland] INDUSTRY Elsag Datamat (Coordinator) [Italy] Thales Research and Technology [UK] ITTI (SME) [Poland] END USERS Telefonica ID Investigación y Desarollo [Spain] Telespazio [Italy] Polska Telefonia Cyfrowa [Poland] ACADEMY Consorzio Interuniversitario Nazionale per l’Informatica [Italy] Lancaster University [UK] Fraunhofer Gesellschaft Zur Foerderung Der Angewandten Forschung [Germany] Eidgenoessische Technische Hochschule Zuerich [Switzerland] INDUSTRY Elsag Datamat (Coordinator) [Italy] Thales Research and Technology [UK] ITTI (SME) [Poland] END USERS Telefonica ID Investigación y Desarollo [Spain] Telespazio [Italy] Polska Telefonia Cyfrowa [Poland]

EC Grant Agreement n Project motivation

EC Grant Agreement n Heterogeneous networks Networks based on different low-level protocols (physical, data link) A data network composed of devices from different manufacturers and/or different types of LANs A heterogeneous network is a network connecting computers and other devices with different operating systems and/or protocols, services and applications Interconnection of different type of networks relying on different communication technologies Interconnection of networks managed by different telecom operators adopting diverse security policies

EC Grant Agreement n Identify and classify the vulnerabilities of heterogeneous and interconnected network infrastructures (wired, wireless, satellite, mobile networks) Create and maintain a network vulnerability database Design and implement an integrated network security framework including different components and tools: –detecting anomalous events –reacting to well-known, as well as new kinds of anomalies –deploying truly distributed countermeasures against ongoing attacks –providing systems with mechanisms for intrusion tolerance, i.e. preventing intrusions from generating a system failure Main objectives

EC Grant Agreement n INTERSECTION Vulnerability Database

EC Grant Agreement n The INTERSECTION framework

EC Grant Agreement n Remediation Reaction Detection Visualization Network Monitoring The real-time intrusion detection and tolerance system

EC Grant Agreement n The INTERSECTION Intrusion Detection System E v e n t B u s

EC Grant Agreement n Stealth attacks –“minimize the cost to and visibility of the attacker but which are about as harmful as brute force attacks” (wireless) – M. Jakobsson et al., Stealth Attacks on Ad Hoc Wireless Networks, 2003 –“become invisible (or at least very difficult to detect) to network-based defences” – A. D. Keromytis et al., Defending Against Next Generation through Network/Endpoint Collaboration and Interaction, 2007 Use case: detection of stealth attacks

EC Grant Agreement n Good candidate as Stealth Attack –“The low-rate attack raises serious concern because it can be significantly harder to detect than more traditional brute-force, flooding style attacks” – H. Sun et al., Defending Against Low-rate TCP Attacks: Dynamic Detection and Protection, 2004 –“low-rate denial of service attacks, unlike high-rate attacks, are difficult for routers and counter-DoS mechanisms to detect” – E. Knightly et al., Low-rate TCP- targeted denial of service attacks and counter strategies, 2006 Low-rate DoS attack

EC Grant Agreement n Short traffic bursts –maliciously chosen duration –maliciously chosen low frequency Evade rate-controlling detection mechanisms Periodically keeps the network very busy Influences the TCP congestion control mechanisms of hosts sharing network segments between the attacker and the attack target Throttles other TCP flows' rate far below their ideal value Detection of stealth attacks

EC Grant Agreement n Generate traffic traces including low-rate attacks –Shrew attack tools Define traffic metrics for behavioural modelling –Statistical parameters Extract behaviour patterns for attack classification Machine learning algorithms Detection approach

EC Grant Agreement n Feature vectors computation through traces processing –Ad-hoc developed Snort plug-in Feature vectors classification Traffic model extraction by means of several supervised machine learning algorithms –Decision Tree J48 –SVM –Bayesian Network –Boosting Model extraction

EC Grant Agreement n The INTERSECTION demonstrator

EC Grant Agreement n Contacts Website : Information : Project Coordinator: Stefano Vertechi Technical Coordinator : Salvatore D’Antonio Networking Station EU-Canada Future Internet Workshop