VERCA
: Verteilte Erkennung von Cyber-Attacken mittels intelligentem kollaborativen IDS
The already more complex malware variants, large-scale distributed denial of service (DDoS) attacks or the reported incidents triggered by advanced persistent threats (APT) are worrying and are assuming new proportions from year to year.
To counter this increasing threat, various approaches of anomaly-based intrusion detection systems (IDS) from different manufacturers have established themselves as a proven means of detecting mainly unknown attacks (zero-day attacks), despite their high false positive rate. They assume that they can first model the normal behaviour of the underlying infrastructure and then effectively detect deviating behaviour as an attempted intrusion or attack (anomaly).
However, in highly distributed and heterogeneous IT infrastructures, as typically found in large organisations and companies, the introduction of such an IDS must be critically evaluated. The combination of software and hardware coupled with divergent user behaviour at different locations means that a central IDS cannot capture the complex normal state of the entire system. For holistic protection, however, this global view is indispensable. In recent years, distributed and collaborative IDSs have been developed that collect and analyse information from different infrastructures in an attempt to gain a more global view of highly distributed attack scenarios.
Due to their loose coupling, collaborative IDSs (CIDS) overcome local limitations by sharing relevant data with each other, thus obtaining a much broader view than traditional IDSs in distributed infrastructures. However, existing approaches or frameworks show significant weaknesses.
Our research has shown that many of these systems are only designed to detect certain classic attack types (e.g. worm insertion or access control violation) (using very limited alert correlation techniques), the majority are not resilient to attacks on their own infrastructure, and massively sensitive data is poorly exchanged and therefore privacy policies are often neglected when improving attack detection.
However, answering these and other research questions is of particular importancein the context of the Internet of Things (IoT) (see also Implementation Strategy Industry 4.0).
In this context, we have initiated the new research project VERCA , which overcomes the mentioned disadvantages of existing distributed IDS andoffers aholistic solution approach.In our previous research project IntErA, we have already developed important basic concepts such as the detection of attacks based on IPFIX data or the automated generation of zero-day signatures, which will be incorporated into the development of the VERCA prototype.
Core ideas and challenges
In the VERCA research project, an intelligent CIDS with a high detection rate of known and unknown attacks and parallelisation options is to be developed that meets current requirements for effective protection against complex attacks (such as DDoS and APT) on IT and network infrastructures. In particular, the following core problems must be investigated for this purpose:
- Developing approaches to detect modern highly distributed attacks, combining anomaly-based and signature-based models in the form of a hybrid approach.
- Determination of an effective dynamic communication architecture of the CIDS (centralised, hierarchical, fully distributed or combinations thereof, possibly based on distributed peer-to-peer algorithms).
- Development of efficient distribution and correlation mechanisms so that exchanged alert information from different IT infrastructures leads to more effective local anomaly detection and thus distributed attack scenarios can be detected at an early stage through a global view (granularity of information, global monitoring)
- Collective exchange of security-critical information and resolution of occurring model conflicts between system components (including signature matching and majority voting)
- Categorisation of occurring alarms and derivation of suitable preventive measures to protect against recurring attacks
- Securing the overall system against external and internal compromise attempts: as an IT system, a CIDS itself must be hardened against attacks (Resilient CIDS), so that concepts for global security solutions such as confidentiality and integrity of exchanged information, but also access control mechanisms and system availability must be investigated and solution approaches developed and implemented
- Development of new methods for preserving local and global data protection policies when exchanging sensitive data for the overall system
- Development of a visualisation concept with isolated views for the involved parties
- Further development of suitable network management and monitoring solutions (cf. SDN/NFV, streaming telemetry) for early detection and containment of anomalies in network traffic and support of proactive defence procedures
- Shifting the detection and correlation mechanisms towards a programmable control/date plane of the network used (cf. In-Network Attack Detection, In-band Telemetry)
- Close interlocking of CIDS components with network and cloud infrastructure platforms as a basis for dynamic and adaptive detection of distributed attacks and reduction of the false positive rate through the inclusion of management, discovery and logging data of the monitored infrastructure.
- Inclusion of machine learning methods for the evaluation of fine-granular and high-resolution management and streaming logging data (cf. Cognitive Management, Network Automation).
- Prototypical implementation of a scalable CIDS for massively distributed IT infrastructures.
Cooperation partner
Radar Cyber Security |
| Harald Reisinger RadarServices Smart IT-Security GmbH, Vienna (Austria) |
Intelligent Embedded Systems |
| Prof. Dr. Bernhard SickUniversity of Kassel |
Kontakt
Prof. Dr. Ulrich Bühler
Applied Mathematics, Cryptography, IT Security
Kontakt
Prof. Dr. Sebastian Rieger Programme Director Applied Computer Science (B.Sc.)
Multimedia Communication Networks
Keywords:
IT security, network security, collaborative intrusion detection systems, cloud infrastructure, big data, data aggregation and correlation, information and knowledge sharing
Funding:
Federal Ministry of Education and Research (BMBF)
Project duration:
15.04.2019 - 14.04.2022
