PNNL-13501 - Pacific Northwest National Laboratory

Study Control Number: PN00060/1467
Interactive Network Traffic Modeling
Newton Brown
The Department of Energy has an urgent requirement for technology to protect its computer networks and information
systems. Neither current technology nor the computer security industry offers adequate capabilities for the level of cyber
protection expected of DOE.
Project Description
The computer and network intrusion detection research
field is in its infancy. This field is driven by the emerging
electronic commerce, the Internet, and highly publicized
and ever increasing computer hacker attacks. A total
intrusion protection capability does not exist and is
unlikely in the near future. Most, if not all, commercial
and shareware intrusion detection solutions provide data
on a small percentage of the total network transactions for
external sources. These systems require highly skilled
computer system administrators to configure, operate, and
analyze the massive logs that they can generate. They are
labor-intensive, expensive, rigid, and slow. Network
traffic is dynamic and the rate of increase in volume is
accelerating. Today’s intrusion detection technology in
the current architecture of static, signature-based
configuration cannot adapt to change in an automated
way. To adequately respond to these conditions, the
system administrator needs to study massive logs, then
reconfigure the tools for change.
The interactive network traffic modeling hypothesis seeks
to enhance the infrastructure for the next generation of
intrusion detection capabilities that will include the realtime
display of sniffer data in the form of interactive
visual and textual models. These models will have the
capability to dynamically adjust sniffer collection
parameters based on network conditions and the decisions
made by analysis tools running on top of the models. The
capability to dynamically alter collection parameters
based on model changes will allow for greater detection
granularity, number of incidences, and efficient use of
skilled system administrators, who are costly and in short
supply.
The most important aspect of intrusion detection is the
ability to capture compromising threats at the time of
occurrence. In today’s environment, organizations
assume significant risk by letting any single intrusion
event go undetected. Security breaches can have a
160 FY 2000 Laboratory Directed Research and Development Annual Report
profound effect on a company’s bottom line and
reputation. In the case of DOE, the event could be a
compromise of national security information associated
with nuclear weapons.
Introduction
Within the domain of intrusion detection sensors, this
research focuses on new technologies to improve the
collection of data, both in quality and in quantity. First,
automated control of dynamic sensors provides the
capability to alter collection parameters on the fly in
reaction to events. Second, for the information display
component, the research focus is on displaying more data
rapidly in a means readily comprehensible by the analyst.
Third, for real-time capture component, the research
investigates detection methods conducive to real-time
processing. Integration of these three components will
form a tightly coupled system that operates during the
data collection process. Thus, this project is creating
interactive intelligent models that will control the
collection and dissemination of data for intrusion
detection sensors systems and other analysis tools.
For intrusion detection sensors, the goal was to
encapsulate standard network sniffers with intelligent
agent technology created in the Internet Technology
Library for the Internet characterization tool, presentation
server, and the flash ROM projects. Advances in
software agent technology specific to intrusion detection
sensors were used to interface with network sniffers, to
create those that can be modified, moved, and controlled
at run time. This will allow for a small window of the
data that we can see and process to be moved around
dynamically and adjusted directly in response to certain
events and thresholds. The agent event engine can allow
for automated focusing on specific events based on
actions or stimuli that it detects or that are defined by the
analyst. Agent technology will also allow for more
complex filters that can weed out noise and allow for
more targeted data collections.