lane.thames '@' gtsav.gatech.edu lane.thames '@' gtsav.gatech.edu
PhD Electrical and Computer Enginnering, Georgia Institute of Technology
Estimated Time of Completion: December 2008
Advisor: Dr. Randal Abler
I am working on a system that I call a Firewall Collaboration Framework (FCF). This system is built with a "federation" of firewalls that collaborate with each other and share a "global" pool of information. The concept is as follows: Once a collaborating firewall in the federation classifies a network traffic flow as abnormal (such as a flow with malicious intentions), classification information is distributed to the other firewalls in the federation. The other firewalls can then update their firewall rules and this will prevent the malicious flows from ever entering their respective networks. The implications of this system are that worms, viruses, spam, etc. could, in some cases, be stopped at the source (assuming that the source must pass through a collaborating firewall). The results of this work were published in the proceedings of the IEEE Southeast Conference (IEEE SoutheastCon 2007), March 2007.
The next step in my research will be to extend the concepts of my FCF to a more generalized network security collaboration framework. Actually, the FCF is a particular case of the GNSCF that only uses firewall network elements. However, the GNSCF will be a framework for any network element such as routers, switches, firewalls, and individual network hosts. The utility of this system will increase as the number of federation members increases. Each member acts like a sensor that detects malicious behavior and distributes this information to the federation. Hence, as more elements join the federation, the overall view of the network increases and the probability of detecting malicious behavior and distributing the behavioral profile increases as well. The framework will encompass ideas such as the following:
There has been much research in the area of Intrusion Detection Systems (IDS). However, the field is still in its infancy. My work in this area includes the use of Intelligent System Algorithms and their effectiveness in classifying computer network anomalies such as malicious user activity. I developed a hybrid intelligent system that used Self-Organizing Maps (SOM) and Bayesian Probabilistic Learning Networks. These algorithms were used to classify network and host-based data-flows. The classification resulted in a probabilistic prediction of the data-flows as being malicious (abnormal) or normal. The system could be used as a simple IDS where it would classify data-flows and either allow or deny incoming data-flows based on a probabilistic threshold. The results of this work were published in the proceedings of the ACM Southeast Conference (ACMSE06), March 2007.
A general note on the term "Hacking." The nomenclature in the Information Technology field is mixed when one speaks about computer attacks and other malicious computer activity. Some schools of thought refer to malicious computer behaviour as "hacking" and others refer to it as "cracking." Terms such as white-hat and black-hat are also used. Malicious users are normally labeled as black-hats, and computer security professionals are normally labeled as white-hats. Regarding hacker versus cracker, I prefer to use hacker as an equivalent to white-hat and cracker as an equivalent to black-hat. Therefore, I consider myself to be a HACKER. In order to be an expert in the art of hacking and defending against malicious activity, one must understand the behaviour of the opponent. One can't defeat his opponents without practice and knowledge of the game. This is where the principle of security via obscurity becomes a bit blurry. To this end, I justify publishing the information below. The links provided below are intended to only be used for white-hat security research purposes. There is a Russian Proverb that is used by security experts: "TRUST, BUT VERIFY". Some of the links below will point you to code that can be used in very malicious ways (DoS, gaining remote and/or local root access, worms, viruses, etc). So, "HACK, BUT DON'T CRACK" when you use these links!