Skip Links

CIOs: Your networks have already been compromised

Cybersecurity expert advises flushing out infected PCs, not just tracking inbound traffic

By , Network World
June 05, 2009 09:40 AM ET

Network World -
NEW YORK CITY – CIOs should stop focusing on intrusion detection and prevention systems and start dealing with the computers on their networks that have already been compromised by cybercriminals. That's the advice of a computer science professor from New York University, who is pitching a novel approach to ferreting out infected computers on enterprise networks.

Nasir Memon, Professor of Computer Science and Engineering at the Polytechnic Institute of NYU, has developed a network-based infection detection system to identify compromised host computers on large networks.

"Instead of focusing on blocking the infection from getting in, we assume there is an infection and we focus on detecting the infection," says Memon. "Intrusion prevention is not enough. You have to be watching inside your network very carefully and looking for infections."

Memon described his system—dubbed INFER--at the Cyber Infrastructure Protection Conference held at City College of New York on Thursday.

For more on network research projects, follow our Alpha Doggs blog

INFER is designed to detect the kind of targeted, stealthy attacks that organized crime and foreign countries tend to launch against corporate and government networks. These slow-moving attacks are difficult for network managers to detect with firewalls, anti-virus, intrusion prevention or intrusion detection systems that focus on known malware trying to get inside networks.

INFER, on the other hand, focuses on the malware already inside networks. INFER uses sensors deployed next to routers and switches to passively monitor network traffic and summarize it. INFER has a data mining engine that analyzes the summaries and looks for infected machines.

INFER's console provides network managers with a list of the top 10 host computers that appear to be infected. It also has a forensics component that allows a network manager to track historical traffic patterns on specific hosts.

INFER doesn't look for known malware or attacks, nor does it seek the signatures or behavior patterns associated with them. Instead, INFER looks for hosts displaying symptoms that an infected machine would exhibit, regardless of the infection. INFER checks PCs for a dozen symptoms such as slowdowns, frequent reboots, DNS reconnections and hosts acting like relays or proxies.

"The moment the attacker starts doing things with a compromised machine, it will start showing footprints on the network. That's what we want to focus on," Memon said. "It's like a surveillance camera recording everything that's going on in the network."

INFER creates a synopsis of network traffic, rather than storing all of the network traffic for analysis. By using a synopsis of network traffic, INFER makes it easier for users to store up to three months worth of data and to transfer the data over a network for central review.

The Polytechnic Institute of NYU has been running INFER for two years to track the behavior of 3,000 PCs on its network. "We discover botnets every day, and we report to IT that they are there," Memon said.

Our Commenting Policies
Latest News
rssRss Feed
View more Latest News