* Cetacea Networks’ approach to intrusion detection
In December at the InfoSecurity Conference in New York City, I enjoyed chatting with Gary MacIsaac, president and chief technical officer of Cetacea Networks of Vancouver, Canada. Cetacea Networks makes the OrcaFlow Intrusion Detection Sensor, an appliance designed to monitor network traffic non-obtrusively at speeds up to 10G bite/sec. The device is based on anomaly detection, which means it does not use attack signatures.
In the world of intrusion detection systems (IDS), there are two fundamentally different approaches to identifying attacks:
* “Misuse detection” is based on filtering data streams to detect attack signatures – that is, patterns of packet flows that are characteristic of known attacks.
* “Anomaly detection” is based on recognizing deviations from normal traffic patterns; these systems use statistical methods to identify outliers.
One of the major problems with misuse-detection IDS is that the systems can miss new attacks. This problem is growing in importance as “zero-day” attacks (i.e., attacks developed at the same time as vulnerabilities are announced) become more common.
Anomaly detection systems depend almost entirely on the validity of the baseline data used to define normal behavior; if these systems are trained or normalized on systems where malefactors are active, the unauthorized behavior can be integrated into the baseline.
The OrcaFlow IDS is based on very large data sets and has been adapted to monitor generalized TCP/IP traffic, Ethernet switches, VoIP traffic, cable/DSL modems, wireless access points and mobile devices.
A useful resource on the OrcaFlow Web site is its library of pointers to research published by the Cooperative Association for Internet Data Analysis. Listed papers analyze several worms (Witty, Slammer, Code Red) and denial-of-service attacks.
Finally, the images of killer whales are very beautiful, and there is a link to an organization where you can learn more about these wonderful sea creatures.
