Over the last few years, attack graphs have became a well recognized tool to analyze and model complex network attack. The most advanced evolution of attack graphs, called anticipation games, is based on game theory. However even if anticipation games allow to model time, collateral effects and player interactions with the network, there is still key aspects of the network security that cannot be modeled in this framework. Theses aspects are network cooperation to fight unknown attack, the cost of attack based on its duration and the introduction of new attack over the time. In this paper we address these needs, by introducing a three-fold extension to anticipation games. We prove that this extension does not change the complexity of the framework. We illustrate the usefulness of this extension by presenting how it can be used to find a defense strategy against 0 days that use an honey net. Finally, we have implemented this extension into a prototype, to show that it can be used to analyze large networks security.

Presented at FAST’08, Malaga, Spain

Full paper (PDF)

NetQi is a freely available model-checker designed to analyze network incidents such as intrusion. This tool is an implementation of the anticipation game framework, a variant of timed game tailored for network analysis.
The main purpose of NetQi is to find, given a network initial state and a set of rules, the best strategy that fulfills player objectives by model-checking the anticipation game and comparing the outcome of each play that fulfills strategy constraints. For instance, it can be used to find the best patching strategy.
NetQi has been successfully used to analyze service failure due to hardware, network intrusion, worms and multiple-site intrusion defense cooperation.

Presented at ATVA 2008 (Automated Technology for Verification and Analysis) Seoul, Korea

Full article (PDF)

Slides (PDF)

Published at WISTP 2008 and Awarded Best Paper

With the growing use of protocols obfuscation techniques, protocol identification for Q.O.S enforcement, traffic prohibition, and intrusion detection has became complex task. This paper address this issue with a probabilistic identification analysis that combines multiples advanced identification techniques and returns an ordered list of probable protocols. It combines a payload analysis with a classifier based on several discriminators, including packet entropy and size.
We show with its implementation, that it overcomes the limitations of traditional port-based protocol identification when dealing with hard to classify protocol such as peer to peer protocols. We also details how it deals with tunneled session and covert channel.

Author Version (PDF)

Accepted paper at ASIAN 2007 at Carnegie Mellon University in Qatar.

Abstract

We present a logic-based framework to evaluate the resilience of computer networks in the face of incidents, i.e., attacks from malicious intruders as well as random faults. Our model uses a two-layered presentation of dependencies between files and services, and of timed games to represent not just incidents, but also the dynamic responses from administrators and their respective delays. We demonstrate that a variant TATL$\Diamond$ of timed alternating-time temporal logic is a convenient language to express several desirable properties of networks, including several forms of survivability. We illustrate this on a simple redundant Web service architecture, and show that checking such timed games against the so-called TATL$\Diamond$ variant of the timed alternating time temporal logic TATL is EXPTIME-complete.

Files

Incident Logic author version (PDF)

This work was presented at NordSec 2007: The 12th Nordic Workshop on Secure IT Systems as short paper.

In this paper we introduce a new technique to count the number of hosts behind a NAT. This technique based on TCP timestamp option, works with Linux and BSD system and therefore is complementary to the previous one base on IPID than does not work for those systems. Our implementation demonstrates the practicability of this method.

Time has something to tell us about Network Address Translation (PDF Version)

@InProceedings{ Bursztein2007_1,
title = “Time has something to tell us about Network Address Translation”,
booktitle = “NordSec 2007″,
author = “E. Bursztein”,
month = “Nov.”,
year = “2007″
}

Intrusion Detection Systems (IDS) are used to discover several kinds of attacks. Commercial solutions are, generally centralized and suffer from significant limitations when used in high speed networks. This is one of our major motivations to use distributed model based on agent platform. We believe that agent facilities will help collecting efficent and useful informations for IDS. We also propose to use a combined analysis by invoking speciallized agents. The idea is to have a signature based agent, temporal analysis agent and behavior analysis agent. By combining three ananlysis, our IDS will be able to detect several kinds of attacks and intrusions. Before introducing our global agent IDS architecture, we need to validate the agent palteforme use and verify a set of security features. The first step is to choose a platforme which can offer security mechanisms needed by IDS solutions. In this paper, we first sum up IDS security needs, we introduce a set of comparison criteria and we present a security feautures study of agent platforme. After studying Concordia, JADE, Aglet, Voyager, Agent-TCL , MAP and JATLite platformes, we introduce our agent IDS by presenting the global architecture and future works.

Toward Agent IDS: agent platform security features study abstract

Toward Agent IDS: agent platform security features study slides