Collaborating Against Common Enemies.pptVIP

Collaborating Against Common Enemies Sachin Katti Balachander Krishnamurthy and Dina Katabi ATT Labs-Research MIT CSAIL Current Intrusion Detection Potential reasons for collaboration: Provides global picture of attack Detecting low rate distributed attackers Detecting stepping stones Talk Is About Correlated Attacks Define Correlated Attacks: as attacks from the same sources IP on different IDSs/networks Talk Is About Correlated Attacks Define Correlated Attacks: as attacks from the same source IP on different IDSs/networks This Talk 40% of alerts are correlated Correlated attacks within 10min An IDS sees correlated attacks with 8 IDSs (out of 1700), and the group does not change Dataset Method Correlation is based on sharing the same source IP Adding info about attack type and dest port did not matter Correlated IDSs – IDSs for which more than 10% of their attacks are correlated Do IDSs see Correlated Attacks? 20% of attacking IPs are common attackers 40% of the attacks are correlated On average, 1500 correlated attackers/ day/IDS Interarrival of Correlated Attacks Size of Correlation Groups For each IDS compute the # of IDSs with which it is correlated Do Correlation Groups Change? Why IDS correlate? Is it proximity in IP space? Is Proximity in IP Space the Reason? Compute cross correlation between proximity in IP space and correlated IDS Why IDS correlate? Is it proximity in IP space? Is Similarity in Software the Reason? Compute cross correlation between similarity in software attack correlation So, what does it mean for Collaborative Intrusion Detection? Issues for IDS collaboration across networks Is it useful? How often should IDS exchange information? How to make it scale? How does an IDS trust its collaborators to protect the privacy of its information and not lie? Exploiting Correlation for collaboration 40% of alerts are correlated Correlated attacks within 10min An IDS sees correlated attacks with small correlation groups (8 out o