Subscribe to our e-mail newsletters
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Tools Coming for Digital Immunity
Coming for information security: tools for adaptive and resilient computing.
Gary Anthes
Today’s Top Stories 
or
Other Security Stories
or
Other Security Stories
|
|
|
|
December 22, 2003 (Computerworld) -- The battle against computer viruses and system intruders is often described as an arms race, in which increasingly powerful weapons are countered by ever stronger defenses. But this particular arms race isn't in a dead heat; the mavens of malware are winning it.
There are several reasons: Computers are increasingly connected by high-speed links, facilitating the spread of malware; software is growing in complexity, and with complexity comes vulnerability; and attack weapons are increasing in sophistication and ease of use [see diagram].
But there is hope, say a new breed of computer security researchers. A number of them met recently at a workshop called Adaptive and Resilient Computing Security at the Santa Fe Institute in New Mexico and unveiled ideas for an arsenal of new defenses. The measures are based on widely varying concepts, and they range from ideas to working prototypes to nascent commercial products. But they share these characteristics:
- They don't rely on predetermined definitions such as virus signatures, attack scenarios and vulnerability exploits. Thus, they're able to recognize attacks that haven't occurred before.
- They're intended to allow a system to keep running in the face of an attack, albeit often at a reduced level of effectiveness.
- They learn and adapt to changing attack scenarios.
- They limit false alerts, which can render defense systems unusable.
Some researchers are drawing inspiration from biology. "The biological immune system is an elaborate defense system which has evolved over millions of years, probably through extensive redesigning, testing, tuning and optimization," says Dipankar Dasgupta, director of the Intelligent Security Systems Research Lab at The University of Memphis. Dasgupta points out that the human body protects itself in multiple ways. The skin and mucous membranes act to prevent the entry of pathogens into the body. But if pathogens do succeed in entering the body, innate immune reactions come into play, as do acquired or "adaptive" immunities that learn from past infections. In addition, the body employs defense mechanisms at various levels—cellular, molecular, peptide/protein and DNA.
 |  |
| Dipankar Dasgupta of the University of Memphis | |
But Dasgupta's lab has built software prototypes that address that weakness. His Security Agents for Network Traffic Analysis uses mobile software agents for intrusion detection in a network of computers. Agents monitor at multiple levels—packet, process, system and user—using neural networks to spot anomalous behavior and "fuzzy rules" to decide what action the agents should take in the face of an attack.
Variation Helps
Stephanie Forrest, a computer science professor at The University of New Mexico, points out that diversity in biological and ecological systems leads to robustness and resilience. "But our software is almost a monoculture," she says. She's working on "automated diversity for security," in which each system is made unique by arbitrary random changes. "That increases the cost of attack, because the attack has to be adapted for each computer," she says.
Diversity can be created in a number of ways, such as by adding nonfunctional code, reordering code or randomizing memory locations, file names or system calls.
Other researchers are experimenting with a measure called Kolmogorov Complexity, the minimum number of bits a character string can be compressed into without losing information. Scott Evans, a researcher at GE Global Research, has used it to study attack scenarios.
Evans analyzed file transfer protocol logs and found that attacks, such as a stealth port scan, tend to be more or less complex than normal behavior by predictable amounts, allowing a defense tool to identify and block the attacks. The technique is attractive because it is adaptive and requires no attack signature database, Evans says.
Real-world application of some of these ideas lies years in the future, but Steven Hofmeyr, a former graduate student under Forrest, has already commercialized some of them. He's developed Primary Response, which monitors and protects applications at the operating system kernel level. It uses agents to build a profile of an application's normal behavior based on the code paths of a running program, then continually monitors those code paths for deviations from the norm.
Primary Response works at the application level, where 75% of attacks occur, says Hofmeyr, chief scientist and a founder of Sana Security Inc. in San Mateo, Calif. Protection at the application level will become more vital as it becomes more difficult to define the network perimeter, where firewalls work, Hofmeyr says. "When something like Web services really takes off, it will really deal a death blow to perimeter [security], because it's very difficult to determine what's inside the network and what's outside."
When a Primary Response agent spots abnormal behavior, it sends an alert to a central server where it may be directed to block that behavior while letting other activities continue, Hofmeyr says.
Hofmeyr says he'd like to extend Primary Response to tuning and debugging. "A lot of what we see in production environments won't be malicious, but it will be indicators that something is wrong, such as configuration problems or hardware problems," he says. "When I look at the bigger picture, I see this sort of tool as something for system health in general."
| |
|
See more Future Watch articles.
To learn what the military is doing, visit QuickLink 434377.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Storm botnet stages Fourth of July attacks
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
