6th European Conference - Academic Conferences

Evan Dembskey and Elmarie Biermann
Using these layers as our starting point we introduce sub-layers and descriptions as depicted in
Figure 2. We only focus on the Observer and IDS layers.
The observer layer consists of five sub-layers all focusing on gathering information:
Collective Behaviour
Communication Analysis
Resource Gathering
Spreading & Growth Patterns
Network Traffic Analysis
Each of these sub-layers focuses on particular aspects of gathering information through observation.
This observation is conducted through a focused software agent network.
Within network traffic analysis, intensive signature analyses are conducted in order to provide data to
the IDS layer. From these analyses, information on spreading and growth patterns is gathered and
models proposed. Resource gathering focused on observing specifics such as bandwidth depletion
and resource utilizations. Communication analysis refers to the communications taking place between
bots and masters and the analysis thereof. This will assist in determining the collective behaviour or
focus of the botnet as well as assist in detailing the economic focus.
The information gathered within the observer layer is used as input to the IDS layer. The IDS layer will
function as both a HIDS and a NIDS; that is, it will have operational agents on hosts and servers. The
IDS layer includes the following:
Infiltrate and disable
Spawn Intelligent Software Agent Network
Classification
The information gathered within the observer level are use to classify the botnet and according to the
classification an intelligent software agent network is spawned to infiltrate and ultimately disable the
botnet.
Agentification of email client and server software, host and server monitoring software, host and
server firewall and AV software, network monitoring software, user monitoring software is required, or
at least, the capability to interface with these applications.
It is anticipated that the crowd sourcing component will function on two layers. Firstly, SA from
different organizations will communicate threats amongst themselves with minimal supervision.
Secondly, information will be sourced from human beings. Both open and proprietary sources should
be used, but the following two points must be kept in mind. The use of proprietary systems will have a
cost implication and the use of that data may not legally be allowed to propagate through the entire
SA system. Secondly, the possibility of attack vectors being introduced is a real concern – if crowd
sourcing results in false positives through the means of concerted and purposeful false reporting, then
a DoS attack may occur, with the system’s SA falsely identify normal activity as malicious and halt it.
A robust and up-to-date system that can share data on the safety of web sites and software will
mitigate the risk from the primary sources of infection discussed above. The CYBEX (X.1500) is in the
opinion of the authors the correct path to follow to implement this system.
As part of this research we will implement and test a model of the proposed system against a variety
of botnets. The model will not be comprehensive and will focus on mitigating threats launched via
drive-by downloads and locally installed software. The network of NIDS and HIDS with the crowd
sourcing component will be implemented.
We must also consider the impact of virtualization and the trend towards cloud and grid computing,
which we think will continue. It is also not the intention that this system is entirely automated, as the
effect of systemic failure may be worse than anticipated and human intervention may serve to mitigate
this risk.
303