Advanced Attack Detection and Infrastructure Protection Sean Ensz –OU IT Security Analyst Sallie Wright –OSU IT Security Officer Dr. Mark Weiser –OSU Director of CTANS
Agenda Technical Overview – Sean Ensz Production Benefits – Sallie Wright Research Benefits – Dr. Mark Weiser
Technical Overview Core system based on a Honeynet design –A Honeynet is a network of honeypots –A honeypot is an information system resource whose value lies in illicit use of that resource –A honeypot has no legitimate users –Any traffic going to and from the system in inherently suspicious *Source:
Future Improvements Honeywall –Needs better hardware & network driver support –Beta version to be released today Host based logging –Currently relies on Sebek –Lacks host log and process tree support –Working with Third Brigade to develop a honeypot version of their product
Production Benefits
No real security Program WIDE OPEN IT Security Office Policy Focus Central Anti-virus IDS Border Firewall IT Security Plan LaBrea Tarpit Anti-Spam Intrusion Prevention System AIPS OSU IT Systems Security Evolution
AIPS Production Benefits Identification of malicious hosts Ability to block at the border of Oklahoma’s OneNet state-wide network
Collaboration A key benefit is the ability to provide academic programs with tools to research Develop new ways to strengthen overall IT security.
Production Goal To contain and prevent intrusions while providing the data Flow analysis to tune the IT security process.
Research Benefits
How This May Be Extended –Future Research –Related Endeavors
Day Zero Signature Existing Signatures Candidate Detects HN Design Attacks HN Wild Attacks Day Zero Signature AI/Neural Nets Other Methods Validation
MiddleWare Honeynet “Solution” Platform-neutral Solution (file) Middleware Router Description / Access Information Router/ Firewall
Basic Near-Real-Time Activity Detector Low-cost log gathering w/ local analysis Central Cumulative Analysis Trigger points distribute alerts to subscribers
Sean Ensz Sallie Wright Dr. Mark Weiser