1. Anomaly Detection and Internal Network Security Jose Nazario, Ph.D. Arbor Networks

2. Proprietary and Company Confidential Information Your role is to protect the network

3. Proprietary and Company Confidential Information External barriers aren’t enough

4. Proprietary and Company Confidential Information Your perimeter is porous to threats

5. Proprietary and Company Confidential Information Discover the wolf in sheep’s clothing

6. Proprietary and Company Confidential Information Anomaly Detection helps you find the things that don’t belong

7. Proprietary and Company Confidential Information GOOD BAD

8. Proprietary and Company Confidential Information Characterize the offending source

9. Proprietary and Company Confidential Information Statistical Protocol Relational

10. Proprietary and Company Confidential Information Statistical Anomaly Detection  Based on traffic rates  Endpoints are network blocks  Traffic by time and service  Useful for DDoS attack detection  Statistical expectations and confidence

11. Proprietary and Company Confidential Information Expected = Recent past + Average distant past  Statistical variance Allows for smooth changes Disallows abrupt changes

12. Proprietary and Company Confidential Information BPS Time

13. Proprietary and Company Confidential Information An example of “abrupt change”

14. Proprietary and Company Confidential Information Another “abrupt change”

15. Proprietary and Company Confidential Information Protocol-Based Detection  Based on protocol behaviors  Very generic, requires a well understood protocol  Compare protocol observations with expectations  Useful for very well controlled protocols  Works for various layers: network, applications, etc

16. Proprietary and Company Confidential Information From To Subject Length-based overflow against client Email header attack

17. Proprietary and Company Confidential Information Relational-Based Detection  Uses inter-host relationships  Roles (server, client, services) are usually static  Examine network traffic and peers  Changes in roles indicate odd events

18. Proprietary and Company Confidential Information Catalog Relationships Record every packet, flow, connection, and transaction between every host on the network. Group Automatically By observing incoming and outgoing links, similar protocols spoken, and proximity to other hosts, generate groupings. Generalize Behavior Discover which behaviors are common to the entire group, and apply to every member of the group.

19. Proprietary and Company Confidential Information FTP SMTP HTTP LDAP Service based relationships

20. Proprietary and Company Confidential Information Mail-based viruses Rogue AP Unauthorized connections

21. Proprietary and Company Confidential Information Inside, they don’t use exploits

22. Proprietary and Company Confidential Information Health Care Student Records Web Gateway Not all traffic is authorized

23. Proprietary and Company Confidential Information Catalog service usage over time

24. Proprietary and Company Confidential Information

25. Detect the threat inside the chaos

26. Proprietary and Company Confidential Information HTTP MS SQL Selectively isolate the threat

27. Proprietary and Company Confidential Information  Anomaly detection helps you identify real threats  You can quickly react to specific threats  Minimize the disruption and response time  Protect core assets while offering service

28. Proprietary and Company Confidential Information Thank you