TOTEM: Threat Observation, Tracking, and Evaluation Model John J. Gerber CISSP, GCFA, GCIH, GISP, GSNA “ A totem is any supposed entity that watches over or assists a group of people, such as a family, clan, or tribe .” -- Merriam-Webster

TOTEM : Basic Idea TOTEM? Who Are You Guys? Why Should Anyone Care? How the ANL Federated IDS Data Sharing Model Can Help. Possible Problems. Existing Methodologies/Frameworks. Blended to Create TOTEM. TOTEM. Screen Shots. Future Development.

TOTEM?

Who Are You Guys?

Why Should Anyone Care?

How the ANL Federated IDS Data Sharing Model Can Help.

Possible Problems.

Existing Methodologies/Frameworks.

Blended to Create TOTEM.

TOTEM.

Screen Shots.

Future Development.

What is TOTEM? The idea behind TOTEM is simple: Pick up where the ANL model stops. Compare threat information from sources such as the federated model and other watchlists (DShield, Emerging Threats, SenderBase, etc.). As new threat information and activity sources are added, a better evaluation can be rendered. Use components from the individual site for evaluating risk. Information is gathered and visualization provided. “ Totemism : system of belief in which humans are said to have kinship or a mystical relationship with a spirit-being, such as an animal or plant. The entity, or totem, is thought to interact with a given kin group or an individual and to serve as their emblem or symbol.” -- Encyclopædia Britannica

The idea behind TOTEM is simple:

Pick up where the ANL model stops.

Compare threat information from sources such as the federated model and other watchlists (DShield, Emerging Threats, SenderBase, etc.).

As new threat information and activity sources are added, a better evaluation can be rendered.

Use components from the individual site for evaluating risk.

Information is gathered and visualization provided.

Who Are You Guys? We are like dwarfs standing upon the shoulders of giants, and so able to see more and see farther than the ancients . – Bernard of Chartres Setting an example is not the main means of influencing another, it is the only means. – Albert Einstein

“ Danger , Will Robinson !” According to a May 6th Wall Street Journal article , the Pentagon confirmed that it detected 360 million attempts to penetrate its networks in 2008, which is up from six million in 2006. The Department of Defense also disclosed that it had spent $100 million in the past six months repairing damage from these cyber attacks.

“ Danger , Will Robinson !” (04/09/2009) Electricity Grid in U.S. Penetrated By Spies reported in The Wall Street Journal . Under the Bush administration, Congress approved $17 billion in secret funds to protect government networks. (05/09/2009) FAA's Web Security Audit: 3,857 Vulnerabilities security audit of the Web applications found 763 high risk, 504 medium risk, and 2,590 low risk vulnerabilities. (04/21/2009) Computer Spies Breach Fighter-Jet Project reported in The Wall Street Journal . Cyber spies have stolen tens of terabytes of design data on the US's most expensive costliest weapons system -- the $300 billion Joint Strike Fighter project. (05/2009) Inspector General report sent to the FAA - Last year, hackers took control of FAA critical network servers and could have shut them down, which would have seriously disrupted the agency's mission-support network. (05/20/2009) NARA suffers data breach reported in Federal Computer Week - the missing drive contains 1T of data with "more than 100,000 Social Security numbers (including Al Gore’s daughter), contact information (including addresses) for various Clinton administration officials, Secret Service and White House operating procedures, event logs, social gathering logs, political records and other highly sensitive information. A Few Other Recent Government Occurrences

It is a Dangerous World “ IDSs have failed to provide value relative to its costs and will be obsolete by 2005.” -- Richard Stiennon , Gartner Analyst, 06/03 http://taosecurity.blogspot.com

It is a Dangerous World "The worldwide wireless LAN (WLAN) intrusion prevention system (IPS) market is on pace to reach $168 million in 2008, a 41 percent increase from 2007 revenue of $119 million, according to Gartner, Inc." -- Gartner Press Release, 09/18/2008 http://taosecurity.blogspot.com

Detection Key Points 4 percent of incidents were detected through event monitoring and other forms of analytic technologies. 82 percent of the cases, victim possessed the ability to discover the breach had they been more diligent in monitoring and analyzing. Organizations lack fully proceduralized regimen for collecting, analyzing, and reporting on anomalous log activity.

Key Points

4 percent of incidents were detected through event monitoring and other forms of analytic technologies.

82 percent of the cases, victim possessed the ability to discover the breach had they been more diligent in monitoring and analyzing.

Organizations lack fully proceduralized regimen for collecting, analyzing, and reporting on anomalous log activity.

ANL Federated IDS Data Sharing Model Basic Idea : an incident at one location can be a precursor to an attack on another similar location. Current Members Argonne National Laboratory (ANL) National Center for Supercomputing Applications (NCSA) Los Alamos National Laboratory (LANL) Lawrence Berkeley National Laboratory (LBNL) Oak Ridge National Laboratory (ORNL) U.S. Computer Emergency Readiness Team/DHS (USCERT) Thomas Jefferson National Accelerator Facility (JLAB) Brookhaven National Laboratory (BNL) Sandia National Laboratories (SNL) Idaho National Laboratory (INL) Fermi National Laboratory (FNAL) National Energy Research Scientific Computing Center (NERSC) Pacific Northwest National Laboratory (PNNL)

Basic Idea : an incident at one location can be a precursor to an attack on another similar location.

Current Members

Argonne National Laboratory (ANL)

National Center for Supercomputing Applications (NCSA)

Los Alamos National Laboratory (LANL)

Lawrence Berkeley National Laboratory (LBNL)

Oak Ridge National Laboratory (ORNL)

U.S. Computer Emergency Readiness Team/DHS (USCERT)

Thomas Jefferson National Accelerator Facility (JLAB)

Brookhaven National Laboratory (BNL)

Sandia National Laboratories (SNL)

Idaho National Laboratory (INL)

Fermi National Laboratory (FNAL)

National Energy Research Scientific Computing Center (NERSC)

Pacific Northwest National Laboratory (PNNL)

ANL Federated IDS Data Sharing Model (2)

ANL Federated IDS Data Sharing Model (3)

ANL Federated IDS Data Sharing Model (4)

Violent Felons in Large Urban Counties A majority (56%) of violent felons had a prior conviction record. Thirty-eight percent had a prior felony conviction and 15% had a previous conviction for a violent felony.

The More Sources the Better? DNS-DB Malware Domain Blocklist maintains a list of domains, pulled from various sources, that are known to be used to propagate malware and spyware. Global Watchlist pulls the list of suspected malicious IPs/Net ranges from different sources such as SANS DShield, Arbor atlas and so forth, then putting all of them in one place. Ninja Chimp Strike Force provides a compiled list of hosts associated with bruteforce attempts, spam, botnets, etc. The list is comprised of data from Arbor Networks, Project Honeypot, Shadowserver, and about 24+ hosts. It is sorted on an hourly basis to keep information current and is consistently changing .

DNS-DB Malware Domain Blocklist maintains a list of domains, pulled from various sources, that are known to be used to propagate malware and spyware.

Global Watchlist pulls the list of suspected malicious IPs/Net ranges from different sources such as SANS DShield, Arbor atlas and so forth, then putting all of them in one place.

Ninja Chimp Strike Force provides a compiled list of hosts associated with bruteforce attempts, spam, botnets, etc. The list is comprised of data from Arbor Networks, Project Honeypot, Shadowserver, and about 24+ hosts. It is sorted on an hourly basis to keep information current and is consistently changing .

Cooperative Protection Program (CPP) Purpose Define, integrate, deploy and operate sensors to collect high quality, information rich network data Data analysis targeted at cyber adversaries and their activities against DOE Detect and deter hostile activities directed at the Department’s information assets Generate summary and alert information about boundary-crossing Internet traffic at DOE sites

Purpose

Define, integrate, deploy and operate sensors to collect high quality, information rich network data

Data analysis targeted at cyber adversaries and their activities against DOE

Detect and deter hostile activities directed at the Department’s information assets

Generate summary and alert information about boundary-crossing Internet traffic at DOE sites

Problems An incident at one location can be a precursor to an attack on another similar location. Limited ACLs. False positives. All sites are not created equal. Mistakes happen. Politics.

An incident at one location can be a precursor to an attack on another similar location.

Limited ACLs.

False positives.

All sites are not created equal.

Mistakes happen.

Politics.

Trust Management Nicolas Luhman [1] defines trust management as: a tool allowing our systems to keep working even if assumption of cooperation doesn't hold. Bernard Baber [2] formulates trust as an expectation about the future, citing three fundamental meanings of trust : Expectation of the persistence and fulfillment of the natural and moral social order. Expectation of technically competent role performance from those we interact with in social relationships and systems. Expectation that partners in interaction will carry out their fiduciary obligations and responsibilities (place other's interests before their own).

Nicolas Luhman [1] defines trust management as: a tool allowing our systems to keep working even if assumption of cooperation doesn't hold. Bernard Baber [2] formulates trust as an expectation about the future, citing three fundamental meanings of trust :

Expectation of the persistence and fulfillment of the natural and moral social order.

Expectation of technically competent role performance from those we interact with in social relationships and systems.

Expectation that partners in interaction will carry out their fiduciary obligations and responsibilities (place other's interests before their own).

Trust and Reputation Modeling Techniques Need : specialized knowledge structures used to predict the reliability of trusting agent's partners in the future interaction using the past experience of interactions with the trustees. Examples Feedback mechanisms used by online auction sites (ex: eBay). User ranking systems used by social networking.

Need : specialized knowledge structures used to predict the reliability of trusting agent's partners in the future interaction using the past experience of interactions with the trustees.

Examples

Feedback mechanisms used by online auction sites (ex: eBay).

User ranking systems used by social networking.

Dilbert and Albert Einstein

CAMNEP: System Architecture System developed by Martin Rehak.

CAMNEP: System Architecture System developed by Martin Rehak. Key Ideas Network Behavior Analysis (NBA) - identifies attacks from traffic statistics. Improves the classification rate by multi-layer combination. Based on extended trust modeling.

Key Ideas

Network Behavior Analysis (NBA) - identifies attacks from traffic statistics.

Improves the classification rate by multi-layer combination.

Based on extended trust modeling.

CAMNEP: Multi-Source Trustfulness Integration

CAMNEP: Agent Specific Clusters

CAMNEP: Reporting

CAMNEP: Conclusions

Risk NIST publication SP 800-30: Risk Management Guide for Information Technology Systems . In the text we read: " Risk is a function of the likelihood of a given threat-source 's exercising a particular potential vulnerability , and the resulting impact of that adverse event on the organization. To determine the likelihood of a future adverse event, threats to an IT system must be analyzed in conjunction with the potential vulnerabilities and the controls in place for the IT system.“ " Vulnerability : A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system's security policy."

Topological Vulnerability Analysis (TVA) Approach Steven Noel, Matthew Elder, Sushil Jajodia, Pramod Kalapa, Scott O'Hare, Kenneth Prole Basic idea : analyze and visualize vulnerability dependencies and attack paths for understanding overall security posture. Populate through automated network discovery, asset management, and vulnerability reporting technology.

Operating with Limited Data Seeing the forest through the trees.

Creating TOTEM Network Capture Nessus/ISS - VSWeb NAC FRAMS Device Exception System (DES) Network Registration System Proxy logs Splunk/log aggregators Flow logs Time Machine Vulnerability Database National Vulnerability Database (NVD) The Open Source Vulnerability Database (OSVDB) Emerging Threat SANS Internet Storm Center (IC) Exploit Conditions IDS/IPS - Snort and Bro Attack Scenario (Threat) Federated Model IPs DNS-DB Malware Domain Blocklist Global Watchlist Ninja Chimp Strike Force

Network Capture

Nessus/ISS - VSWeb

NAC

FRAMS

Device Exception System (DES)

Network Registration System

Proxy logs

Splunk/log aggregators

Flow logs

Time Machine

Vulnerability Database

National Vulnerability Database (NVD)

The Open Source Vulnerability Database (OSVDB)

Emerging Threat

SANS Internet Storm Center (IC)

Exploit Conditions

IDS/IPS - Snort and Bro

Attack Scenario (Threat)

Federated Model IPs

DNS-DB Malware Domain Blocklist

Global Watchlist

Ninja Chimp Strike Force

TOTEM: What is the Point? How does one effectively distinguish false positives from actual threats? The answer may only be visible by looking at multiple sources with different levels of trust and doing a little aggregation and anomaly detection. Our goal is to create attack road maps with weights/prioritizations in order to manage the possible risks.

TOTEM Analysis Trust model defined Past and current traffic Traffic patterns to hosts Traffic volume to hosts Evaluation Engine Traffic acquisition and data processing layer Cooperative threat detection layer Operator and analyst interface layer Data is processed in stages Anomaly detection Trust update Collective trust estimation Method integration History integration

Trust model defined

Past and current traffic

Traffic patterns to hosts

Traffic volume to hosts

Evaluation Engine

Traffic acquisition and data processing layer

Cooperative threat detection layer

Operator and analyst interface layer

Data is processed in stages

Anomaly detection

Trust update

Collective trust estimation

Method integration

History integration

Creating TOTEM: Federated Model The devil is in the details Classic LAMP System Linux Apache MySQL Perl Additional Software GPG GeoIP Graphviz Request Tracker ModSecurity

Classic LAMP System

Linux

Apache

MySQL

Perl

Additional Software

GPG

GeoIP

Graphviz

Request Tracker

ModSecurity

Information Shared by the Federated IDS Data Sharing Model Strictly unclassified information Information on (usually external) IP addresses that was malicious enough to warrant a site response (blocking or other) IP address:tcp/udp port # Time of attack Type of attack Exploit attempted Severity of attack Previous history of offending IP at that site (corporate memory) We could periodically share watch lists Information presented in a standardized exchanged format Small XML file Using IETD standards for cyber data exchange

Strictly unclassified information

Information on (usually external) IP addresses that was malicious enough to warrant a site response (blocking or other)

IP address:tcp/udp port #

Time of attack

Type of attack

Exploit attempted

Severity of attack

Previous history of offending IP at that site (corporate memory)

We could periodically share watch lists

Information presented in a standardized exchanged format

Small XML file

Using IETD standards for cyber data exchange

Other Blacklists Provide Information # watchlist.security.org.my, contact mel@hackinthebox.org # ip/net, source, comment, name, last update (GMT+8) 202.99.11.99, http://www.dshield.org/ipsascii.html, Dshield: Top IPs, dshield-top-ips, 2009/05/13 95.215.76.0/22, www.spamhaus.org/drop/drop.lasso, Spamhaus Block List, spamhaus, 2009/05/13 114.80.67.30, www.emergingthreats.net/rules/bleeding-rbn.rules, ET RBN, rbn, 2009/05/13 122.1.21.148, www.emergingthreats.net/rules/bleeding-compromised.rules, ET, compromised, # domain type original_reference-why_it_was_listed note--pound sign=comment # notice notice duplication is not permitted 00.devoid.us malware www.cyber-ta.org/malware-analysis/DNS.Cumulative.Summary 20090321 scan4lux.info fake_antivirus www.malwaredomainlist.com/update.php 20090505 junglemix.in phishing isc.sans.org/diary.html?storyid=6328 20090505 Wed May 13 07:59:03 CDT 2009 99.254.50.139 99.248.26.177 99.245.29.38 99.234.219.183

Other Blacklists Provide Information (2) Top 10 Blacklist Providers Using 266 IPs from malware. Using 235 IPs from rbn. Using 172 IPs from coolwebsearch and spamhaus. Using 55 IPs from rogue. Using 23 IPs from malspam. Using 20 IPs from dshield-top-blocks. Using 15 IPs from exploit and sql_injection. Using 13 IPs from spyware and trojan. Using 11 IPs from rogue_antivirus. Using 10 IPs from botnet. Total Blacklisted IPs Downloaded : 1214 Blacklisted IPs Added Today : 39

Sample Reports: Blacklist Denotes IPs that are blacklisted by the Internet community more recent than 2009-05-11 17:12:07. Denotes IPs that was blocked by the DOE Federated Community more recent than 2009-05-11 17:12:07. Denotes IPs that was blocked by the DOE Federated Community prior to 2009-05-11 17:12:07.

Denotes IPs that are blacklisted by the Internet community more recent than 2009-05-11 17:12:07.

Denotes IPs that was blocked by the DOE Federated Community more recent than 2009-05-11 17:12:07.

Denotes IPs that was blocked by the DOE Federated Community prior to 2009-05-11 17:12:07.

Sample Reports: Blacklist (2)

Signature Based Information Can be Useful In respect to Snort, we have been looking at trend information for awhile.

Sample Reports: Blacklist (3)

Sample Reports: Shuns Denotes IPs that are blacklisted by the Internet community more recent than 2009-05-11 18:02:07. Denotes IPs that was blocked by the DOE Federated Community prior to 2009-05-11 18:02:07.

Denotes IPs that are blacklisted by the Internet community more recent than 2009-05-11 18:02:07.

Denotes IPs that was blocked by the DOE Federated Community prior to 2009-05-11 18:02:07.

Sample Reports: Shuns (2)

Sample Reports: Shuns (3)

Sample Reports: Shuns (4)

There is a great deal of work yet to be done. Some key areas to develop will be: Additional work on the evaluation engine. Improved visualization. CPP. ICSI Bro. ICSI Time Machine. Integration with Request Tracker (RT).

Additional work on the evaluation engine.

Improved visualization.

CPP.

ICSI Bro.

ICSI Time Machine.

Integration with Request Tracker (RT).

Comments Seriously, I would appreciate any comments. After the presentation, please feel free to contact me. John Gerber [email_address]

Seriously, I would appreciate any comments. After the presentation, please feel free to contact me.

John Gerber

[email_address]

Comments John Gerber [email_address] Thank you for the opportunity to discuss TOTEM.

John Gerber

[email_address]

Thank you for the opportunity to discuss TOTEM.