CT-ISG: Protection Against Malicious Attacks via Quarantine-Tolerant Service Partitioning

本项目是为企业网络开发一个自动防御系统，以抵御蠕虫、病毒和间谍软件等恶意代码攻击。 该系统通过动态和有选择地拦截主机、服务和其他联网设备来响应攻击。 基于防火墙和单独主机隔离的传统遏制系统不足以遏制新一代本地扫描、拓扑、元服务器和传染蠕虫，这些蠕虫可以在企业中迅速传播。 此外，这些系统在这种隔离期间不提供对基本服务的企业范围的保护。为了解决这些缺点，一个全面的企业防御框架，称为SeQuEN（企业网络中的服务隔离）正在开发，实施和评估。 SeQuEN根据服务交互（“行为”）而不是网络的物理拓扑自动识别主机、路由器和交换机进行隔离。由于大多数病毒和蠕虫针对特定的服务和潜在的漏洞，SeQuEN中以服务为中心的隔离有望实现快速遏制恶意攻击。 此外，SeQuEN通过在检测到攻击时激活网络范围的隔离时维护基本服务来增强运营网络的生存能力。 这是通过在提供服务分发和复制的同时将服务拓扑划分为多个隔离区来实现的。 SeQuEN还被集成到攻击模拟引擎（ASE）中，以模拟不同类型的恶意代码攻击，如拓扑、本地扫描蠕虫和间谍机器人。SeQuEN中隔离算法的有效性正在使用从2类IP网络收集的网络跟踪进行评估。

Shin - AbstractThis project is developing an automated defense system for enterprise networks against malicious code attacks such as worms, viruses and spyware. This system responds to attacks by dynamically and selectively quarantining hosts, services, and other networked devices. Traditional containment systems based on firewalls and individual host isolation are not adequate for containing the new generation of local-scanning, topological, metaserver and contagion worms that can spread very quickly through an enterprise. Further, these systems do not provide enterprise-wide protection of essential services during such quarantine. To address these shortcomings, a comprehensive enterprise defense framework, called SeQuEN (Service Quarantine in Enterprise Networks) is being developed, implemented and evaluated. SeQuEN automatically identifies hosts, routers and switches forquarantine based on their service interactions ("behaviors") instead of the physical topology of the network. Since most viruses and worms target specific services and the underlying vulnerabilities, the service-centric quarantine in SeQuEN is expected to achieve fast containment of malicious attacks. Further, SeQuEN enhances the survivability of an operational network by maintaining essential services when a network-wide quarantine is activated upon attack detection. This is achieved by partitioning the service topology into a number of quarantine zones while providing service distribution and replication. SeQuEN is also being integrated within an Attack Simulation Engine (ASE) to simulate different types of malicious code attacks, such as topological, local-scanning worms and spybots. The effectiveness of the quarantine algorithms in SeQuEN is being evaluated using network traces collected from a class-2 IP network.