NEW YORK CITY – CIOs should stop focusing on intrusion detection and prevention systems and start dealing with the computers on their networks that have already been compromised by cybercriminals. That's the advice of a computer science professor from New York University, who is pitching a novel approach to ferreting out infected computers on enterprise networks.
Nasir Memon, Professor of Computer Science and Engineering at the Polytechnic Institute of NYU, has developed a network-based infection detection system to identify compromised host computers on large networks.
"Instead of focusing on blocking the infection from getting in, we assume there is an infection and we focus on detecting the infection," says Memon. "Intrusion prevention is not enough. You have to be watching inside your network very carefully and looking for infections."
Memon described his system—dubbed INFER--at the Cyber Infrastructure Protection Conference held at City College of New York on Thursday.
INFER is designed to detect the kind of targeted, stealthy attacks that organized crime and foreign countries tend to launch against corporate and government networks. These slow-moving attacks are difficult for network managers to detect with firewalls, anti-virus, intrusion prevention or intrusion detection systems that focus on known malware trying to get inside networks.
INFER, on the other hand, focuses on the malware already inside networks. INFER uses sensors deployed next to routers and switches to passively monitor network traffic and summarize it. INFER has a data mining engine that analyzes the summaries and looks for infected machines.
INFER's console provides network managers with a list of the top 10 host computers that appear to be infected. It also has a forensics component that allows a network manager to track historical traffic patterns on specific hosts.INFER doesn't look for known malware or attacks, nor does it seek the signatures or behavior patterns associated with them. Instead, INFER looks for hosts displaying symptoms that an infected machine would exhibit, regardless of the infection. INFER checks PCs for a dozen symptoms such as slowdowns, frequent reboots, DNS reconnections and hosts acting like relays or proxies.
"The moment the attacker starts doing things with a compromised machine, it will start showing footprints on the network. That's what we want to focus on," Memon said. "It's like a surveillance camera recording everything that's going on in the network."
INFER creates a synopsis of network traffic, rather than storing all of the network traffic for analysis. By using a synopsis of network traffic, INFER makes it easier for users to store up to three months worth of data and to transfer the data over a network for central review.
The Polytechnic Institute of NYU has been running INFER for two years to track the behavior of 3,000 PCs on its network. "We discover botnets every day, and we report to IT that they are there," Memon said.
Memon and his students have spun off a company called Vivic to commercialize INFER. So far, Vivic has attracted one paying customer: the U.S. Army Research Laboratory, which plans to use the system for its Interrogator network monitoring program.
INFER also has attracted several pilot customers including the Westchester County, New York government, which is using INFER to monitor 3,000 hosts, and the New York City IT Department is using the system to monitor 43,000 hosts.
In stealth mode until now, Vivic plans to bootstrap its growth rather than try to attract venture capital. Currently, the company is developing a marketing strategy for INFER.
INFER represents a "difference in mindset," Memon says. "Network managers wake up and think how do I keep the bad guys out, but they ignore the bad guys that are already inside."