1 / 7

The Hive Mind: Applying a Security Sensor Network to GENI Spiral 2 Year-end Project Review

The Hive Mind: Applying a Security Sensor Network to GENI Spiral 2 Year-end Project Review. University of California, Davis PI: Sean Peisert Co-PIs: Carrie Gates (CA Labs), Deb Frincke (Battelle) Senior Personnel: Matt Bishop ( UC Davis) , Glenn Fink (Battelle),

aletha
Download Presentation

The Hive Mind: Applying a Security Sensor Network to GENI Spiral 2 Year-end Project Review

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. The Hive Mind: Applying a Security Sensor Network to GENISpiral 2 Year-end Project Review University of California, Davis PI: Sean Peisert Co-PIs: Carrie Gates (CA Labs), Deb Frincke (Battelle) Senior Personnel: Matt Bishop (UC Davis), Glenn Fink (Battelle), ErrinFulp (Wake Forest)Students: Michael Crouse (Wake Forest) , Steven Templeton (UCD) 8/27/2010

  2. Project Summary • Primary Goal: Define and prototype a security layer underlying GENI to allow providers to defend against attacks and misuse. • Investigate GENI reporting requirements to provide support for networking and security experiments. • Use collaborative, decentralized, security algorithm known as a “swarm” model to communicate between sensors, simulating the function of an ant hive. • The result of this will enable GENI to support experiments where there is communication between internal nodes (sensors or routers). • For networking, experiments can test if usage can be improved by communicating of capacity and usage information between routers. • For security, experiments can test the tradeoffs among approaches to exchanging security information between sensors, and where that information might affect firewall or IDS rules. August 27, 2010

  3. Milestone & QSR Status August 27, 2010

  4. Accomplishments 1: Advancing GENI Spiral 2 Goals • Continuous Experimentation: The early Hive Mind prototypes are not ready for consumption by other developers, but later prototypes are planned to be robust enough to be usable by other GENI developers and users. • Integration: For GENI security to be effective, it is essential that security, including the Hive Mind, become a core part of the GENI infrastructure and architecture. We will be talking with ProtoGENI and DETER administrators to tightly integrate the Hive Mind. • Instrumentation and Measurement: The Hive Mind project captures information that is of particular relevance to other security projects, but also has relevance to networking projects running on GENI to monitor, test, and improve network efficiency. • Interoperability: ProtoGENI has been selected as the initial target control framework for the Hive Mind, and will likely make use of certain features of DETER, as well. We hope for a limited deployment on PlanetLab in Year 3. • Identity management: The Hive Mind project will not manage user credentials, but it can be configured to monitor per-user usage patterns and, thus, validate if a user is behaving similarly to how they usually behave, or very differently. Thus, this approach can augment ordinary authentication. August 27, 2010

  5. Accomplishments 2:Other Project Accomplishments • Have early prototypes of Java-based implementations of some agents and sergeants. • Investigating whether some or all of these can/should be moved to faster implementations. • Running experiments to compare efficacy and latency to regular IDSs. August 27, 2010

  6. Issues • There is some question as to how close to the “bare metal” we will be able to get on ProtoGENI and DETER. The closer we get, the better the assurance against compromise. Hardware assurance is optimal, but even aside from that, we may wish to get beneath the VM layer to the control layer provided by the testbed. (Note: hardware integration is one of the expectations behind Intel’s recent acquisition of McAfee.) August 27, 2010

  7. Plans • Plans for the remainder of Spiral 2: • Develop prototypes of monitoring software and distributed sensors • Develop demonstrations for GECs • Develop experimental methodologies and conduct experiments • Investigate the possibility of expanding to PlanetLab • Analyze variations of effectiveness for sensors on varying architectures and topologies • The GPO is starting to formulate goals for Spiral 3. What are your thoughts regarding potential Spiral 3 work? • I would like to see some integration and interaction with other testbeds, including DARPA’s National Cyber Range (NCR), DOE’s National SCADA Testbed (NSTB), and Sandia’s NNSA/ASC testbed. I realize that at least two of these testbeds involve large classified components, but I think researchers working with GENI would like to see broader use of their own work, and I think SCADA & NNSA researchers could benefit from work done on GENI. There should be a way of describing needs, tossing tools “over the fence,” and iterating with “cleared” personnel to obtain useful results. • I’d like to see more complete integration of the available testbeds (ProtoGENI, PlanetLab, DETER, etc…) to obtain the best of all worlds (e.g., real traffic from PlanetLab, containment from DETER, etc..) August 27, 2010

More Related