1. Monitoring for network security and management Cyber Solutions Inc.

2. Why monitoring?  Health check of networked node  Usage and load evaluation for optimizing the configuration  Illegal access detection for both inbound and outbound traffic All networked information is on the LINE

3. Threats have to be monitored  Node alive or dead Network or node fault? Attacked?  Performance degradation Network fault? DoS possibility? Large-scale incident?  Policy enforcement Detecting policy violation (prohibited communication) Detecting configuration change  Potential attack originator Exploited / Compromised by attacker? Attacking by insider? Virus polluted? Malicious terminal connected?

4. Monitoring is the first step for security and network management  Monitoring basics Information collection from every networked node Packet monitoring  Advanced topics High-resolution monitoring Hash-based traceback Simple and light weight analysis for practical monitoring Information collection from mobile node/network Monitoring network inside

5. High-resolution monitoring  Traffic is so dynamic Peak rate is important for actual performance Malicious access is in peaky traffic (pulsing DoS)  Requirement Shift minutes, hours, daily measurement to msec, usec, and further precise measurement

6. 34 Hours 5 Seconds Monitoring with high-resolution

7. time Manager Agent Query and response Current Method Delay time Manager Query and response 1000 *n MOs/packet Agent Scalability by Aggregation

8. The drafts http://wwwietf.org/internet-drafts/ draft-glenn-mo-aggr-mib-02.txt

9. Problems in current counter DoS attack solutions

10. Take the battle to the foe Traceback Traceback potential

11. Internet Source Do you know ? Target Yes ! Around Here! PP Packet Trace Agent Yes ! No ! ← Packet Trace Yes ! The traceback concept

12. The Architecture PRA PR PRB Packet Tracker(PT) Packet Query/Response

13. The Architecture PRA PR PRB Packet Tracker （ PT) Packet Query/Response Conf: Query/Response Setting

14. Requirements: Packet Record Protocol  Mapping: PacketRecord (encoded) Packet s Additional Data for corroboration s Scope of Packet Record which IP header fields are masked) how much of the payload

15. Requirements: Packet Record Protocol Packet Data Key Generation Packet Record Agent Key Storage IP Datagram Key Generation Kg (IP Datagram) Packet Recorder Additional data Key Storage Additional Data

16. Requirements: Communication Protocol  Authenticated s Non Repudiation s Lightweight s Check for existence of a datagram s Query for Packet Recording parameters  Privacy, Integrity

17. The Process: Packet Data Transform PRA Packet Record Base IP Datagram Transform Tr (IP Datagram) PR Additional data Packet Record Base Additional Data IP Datagram Transform PT Yes/No

18. Demonstration: Tracking Attacks using SNMP based packet tracing The Internet PRA Packet Record Agent PRA2 IETF wired network Attacker2 IETF wireless network Attacker1 Victim on remote network 1.Attacker1 sends packet to Victim. 2.IDS detects it and sends SNMP trap to manager along with packet’s “record”. 3.Manager queries packet record agents PRA1, PRA2 and PRA3 for packet record 4.Manager receives responses from PRA1, PRA2, PRA3 and traces packet path. attack IDS Manager SNMP Trap Query and Response PRA1 PRA3 Intrusion Detect Sensor IDS

19. Demonstration: Screen shot

20. For practical network monitoring  Simple and right weight monitoring Focusing on stability of traffic Simple event generation and deep inspection Monitoring and Stability analysis Deep inspection Packet Sample DB Event notification

21. Stability example Observed source address is stable in large scale network

22. Mobility issues Some times disconnected changing network changing place/environment Access to more information

23. Mobility issues (1) not continuously connected Usual polling paradigm will not work Agent initiated polling Agent intitiated informs Store locally (Offline) Store and forward (Semi-online)

24. time Manager Current Method

25. time Manager Current Method

26. time Manager Agent initiated Polling

27. time Manager Agent initiated informs

28. Conventional defense strategy Intranet WEB seriver Mail server Firewalling DMZ Monitoring by IDS  Monitoring access from outside to inside

29. Risks network inside Exploited and/or compromised Prohibited user access From DHCP/Wireless network Virus influenced node Potential insider attacks

30. Monitoring inside Detection non-authorized terminal Prevent illegal outbound access  Monitoring Log collection and audit DHCP and/or connection activity monitoring Application traffic from inside to outside Connectivity and log monitoring

31. Summary  Monitoring is the real base of network security and the management  Further advanced monitoring is required High-resolution  New security applications are required Packet traceback  Further practical analysis is required Stability based analysis  Future network environment support is required Mobile node and network support  New monitoring target is required Network inside