140 likes | 155 Views
THE INTERNET MOTION SENSOR: A Distributed Blackhole Monitoring System. Presented by: Bruce Meeks, Jr. Authors: Michael Bailey, Evan Cooke, Farnam Jahanian, Jose Nazario, and David Watson Publisher: Electrical Engineering and Computer Science
E N D
THE INTERNET MOTION SENSOR: A Distributed Blackhole Monitoring System Presented by: Bruce Meeks, Jr. Authors: Michael Bailey, Evan Cooke, Farnam Jahanian, Jose Nazario, and David Watson Publisher: Electrical Engineering and Computer Science Department, University of Michigan
INTRODUCTION AND MOTIVATION • National Infrastructure of global networks vulnerable to rapidly growing internet threats • Amongst them, fast moving worms, distributed denial of service attacks, and routing exploits
INTRODUCTION AND MOTIVATION • Threats’ share several key components: 1) globally scoped 2) occasional zero-day threats 3) evolutionary characteristic 4) many are exceptionally virulent
One promising method for investigating these threats is monitoring unused or dark address space Two key design challenges necessary to incorporate this monitoring infrastructure: AUTHORS’ PROPOSED METHODS FOR MONITORING AND ANALYSIS
SENSOR COVERAGE • The visibility of the system into Internet threats • One method to increase visibility is to monitor larger blocks of address space
SERVICE EMULATION • Difficult to emulate realistic Internet services because the IMS doesn’t interact with live hosts • An ideal system would reproduce all current and future services with exactly the same behaviors as all possible end-hosts.
MAIN CONTRIBUTIONS • The design and implementation of a distributed, globally scoped, Internet threat monitoring system - IMS architecture • The deployment and demonstration of the IMS on production networks - Current deployment and observations
INTERNET MOTION SENSOR ARCHITECURE • Offers Three Novel Contributions: • Distributed Monitoring Infrastruture • 2) Lightweight Active Reponder • 3) Payload Signatures and Caching
INTERNET MOTION SENSOR ARCHITECURE1st Novel Contribution Distributed Monitoring Infrastructure - Distributed deployment to increase visibility
INTERNET MOTION SENSOR ARCHITECURE2nd Novel Contribution Lightweight Active Responder - Characterize threats on emerging ports and services - Essentially a honeypot (low responsive)
INTERNET MOTION SENSOR ARCHITECURE2nd Novel Contribution Light Weight Active Responder
INTERNET MOTION SENSOR ARCHITECURE3rd Novel Contribution Payload Signatures and Caching • Only stores new payloads • Storage conservation • Identifies new payloads ** Note: Goal of IMS is to measure, characterize, and track a broad range of Internet threats **
Deployment Observations and Experiences • Three events captured using IMS deployment: • Internet Worm activity • Scanning • 3) DDoS
Weaknesses of Paper • Next step of counteraction after detection ? • Why should this method of monitoring and analyzing be superior to others? • Provides little to no information on defending against threats that depend on application level responses.