1. Advanced Attack Detection and Infrastructure Protection Sean Ensz –OU IT Security Analyst Sallie Wright –OSU IT Security Officer Dr. Mark Weiser –OSU Director of CTANS

2. Agenda Technical Overview – Sean Ensz Production Benefits – Sallie Wright Research Benefits – Dr. Mark Weiser

3. Technical Overview Core system based on a Honeynet design –A Honeynet is a network of honeypots –A honeypot is an information system resource whose value lies in illicit use of that resource –A honeypot has no legitimate users –Any traffic going to and from the system in inherently suspicious *Source: www.honeynet.org

6. Future Improvements Honeywall –Needs better hardware & network driver support –Beta version to be released today Host based logging –Currently relies on Sebek –Lacks host log and process tree support –Working with Third Brigade to develop a honeypot version of their product

7. Production Benefits

8. No real security Program WIDE OPEN IT Security Office Policy Focus Central Anti-virus IDS Border Firewall IT Security Plan LaBrea Tarpit Anti-Spam Intrusion Prevention System AIPS 2000 2001-2002 2003-2004 2005 OSU IT Systems Security Evolution

9. AIPS Production Benefits Identification of malicious hosts Ability to block at the border of Oklahoma’s OneNet state-wide network

10. Collaboration A key benefit is the ability to provide academic programs with tools to research Develop new ways to strengthen overall IT security.

11. Production Goal To contain and prevent intrusions while providing the data Flow analysis to tune the IT security process.

12. Research Benefits

13. How This May Be Extended –Future Research –Related Endeavors

14. Day Zero Signature Existing Signatures Candidate Detects HN Design Attacks HN Wild Attacks Day Zero Signature AI/Neural Nets Other Methods Validation

15. MiddleWare Honeynet “Solution” Platform-neutral Solution (file) Middleware Router Description / Access Information Router/ Firewall

16. Basic Near-Real-Time Activity Detector Low-cost log gathering w/ local analysis Central Cumulative Analysis Trigger points distribute alerts to subscribers

17. Sean Ensz ensz@ou.edu Sallie Wright sallie.wright@okstate.edu Dr. Mark Weiser weiser@okstate.edu