Advanced Attack Detection and Infrastructure Protection

Advanced Attack Detection andInfrastructure Protection

Sean Ensz –OU IT Security Analyst

Sallie Wright –OSU IT Security Officer

Dr. Mark Weiser –OSU Director of CTANS

Agenda

• Technical Overview – Sean Ensz

• Production Benefits – Sallie Wright

• Research Benefits – Dr. Mark Weiser

Technical Overview

• Core system based on a Honeynet design– A Honeynet is a network of honeypots– A honeypot is an information system resource

whose value lies in illicit use of that resource– A honeypot has no legitimate users– Any traffic going to and from the system in

inherently suspicious

*Source: www.honeynet.org

Vmware ESX

EdgeIron 24GConsole

FOUNDRYNETWORKS

21 22 23 24 1 3 5 7 9 11 13 15 17 19 21 23

2 4 6 8 10 12 14 16 18 20 22 24

Link/Act

Local DB Switch

VLAN Trunk

Management VLAN Trunk

Honeypot

Honeypot Honeypot

Honeypot

Honeywall Layer 2 Bridge

Log Generators

Log Subsystems

Log Collectors

Actions

Network Traffic Network TrafficNet Switch Honeywall Hosts

Snort IPTables pcap Evt Logs Sebek HIDSFlow Data

Local DB

-Rebuild Honeypot-Assign Initial Severity-Export

Export

Export TablesMySQL

Central DB

-Increase Severity-Add to Null Route Table

Future Improvements

• Honeywall– Needs better hardware & network driver support– Beta version to be released today

• Host based logging– Currently relies on Sebek – Lacks host log and process tree support– Working with Third Brigade to develop a honeypot

version of their product

Production Benefits

No real securityProgram

WIDE OPEN

IT Security Office

Policy FocusCentral Anti-virus

Border FirewallIT Security PlanLaBrea Tarpit

Anti-SpamIntrusion Prevention

SystemAIPS

2001-2002

2003-2004

OSU IT Systems SecurityEvolution

AIPS Production Benefits

•Identification of malicious hosts

•Ability to block at the border of Oklahoma’s OneNet state-wide network

Collaboration

•A key benefit is the ability to provide academic programs with tools to research

•Develop new ways to strengthen overall IT security.

Production Goal

•To contain and prevent intrusions while providing the data

•Flow analysis to tune the IT security process.

Research Benefits

• How This May Be Extended – Future Research – Related Endeavors

Day Zero Signature

ExistingSignatures

CandidateDetects

HN DesignAttacks

HN WildAttacks

Day ZeroSignature

AI/Neural Nets

Other Methods

Validation

MiddleWare

Honeynet“Solution”

Platform-neutralSolution (file) Middleware

Router D

escription /A

ccess Information

Router/Firewall

Basic Near-Real-Time Activity Detector

• Low-cost log gathering w/ local analysis

• Central Cumulative Analysis

• Trigger points distribute alerts to subscribers

Sean Ensz

ensz@ou.edu

Sallie Wright

sallie.wright@okstate.edu

Dr. Mark Weiser

weiser@okstate.edu

Advanced Attack Detection and Infrastructure Protection

Documents

Detection System Regarding to Attack Detection on

Shilling attack detection utilizing semi-supervised ...jselab.nufe.edu.cn/download/journal/Shilling Attack Detection Utilizin… · Shilling attack detection utilizing semi-supervised

Generalized Iris Presentation Attack Detection Algorithm under …iab-rubric.org/papers/2021_ICPR_GeneralizedIris.pdf · 2020. 11. 9. · Generalized Iris Presentation Attack Detection

An Undirected Attack Against Critical Infrastructure...seconds. Elements of the worm’s attack are as follows: 3 There is a firewall and intrusion detection at the Internet perimeter

An Introduction to Presentation Attack Detection

Biometric technologies and behavioral securityPresentation Attack Detection • Fingerprint Presentation Attack Detection (also called «Liveness» or «Spoofing» detection) is intended

TCP Attack Detection HTTP Attack Detection UDP Attack Detection - Intel… · 2018-04-30 · Applyflexible security policy that is suitable for Network environment with protection

Face Presentation Attack Detection by Exploring …openaccess.thecvf.com/content_cvpr_2017_workshops/w6/...Face Presentation Attack Detection by Exploring Spectral Signatures R. Raghavendra,

Walking Stick With Heart Attack Detection

An Indirect Attack on Computing Infrastructure …assured-cloud-computing.illinois.edu/files/2016/08/...Proposed Attack Model •An indirect attack on the Computing Infrastructure

Attack Transformation to Evade Intrusion Detection

Attack Detection Using Honeynets

DDOS ATTACK DETECTION IN TELECOMMUNICATION NETWORK …

DigitalWatering Hole Attack Detection Using …...Digital Watering Hole Attack Detection Using Sequential Pattern 3 information. Later, the watering hole attack was found in Rapids7

GA Based Q-Attack on Community Detection · give two heuristic attack strategies, i.e., Community Detection Attack (CDA) and Degree Based Attack (DBA), as baselines, uti-lizing the

Enhanced detection and isolation of angle of attack …elib.dlr.de/104747/1/final_aiaa2016.pdfEnhanced detection and isolation of angle of attack ... An enhanced detection and isolation

Attack Detection and Identification in CPS

An Indirect Attack on Computing Infrastructure through ... · •An indirect attack on the Computing Infrastructure through alteration of the CPS •Often, Computing Infrastructure

Intelligent Detection System Enabled Attack Probability

Attacks and Attack Detection Quirin Scheitle