Presentation is loading. Please wait.

Presentation is loading. Please wait.

NetSEC: metrology-based application for network security Jean-François SCARIOT Bernard MARTINET Centre Interuniversitaire de Calcul de Grenoble TNC 2002.

Similar presentations


Presentation on theme: "NetSEC: metrology-based application for network security Jean-François SCARIOT Bernard MARTINET Centre Interuniversitaire de Calcul de Grenoble TNC 2002."— Presentation transcript:

1 NetSEC: metrology-based application for network security Jean-François SCARIOT Bernard MARTINET Centre Interuniversitaire de Calcul de Grenoble TNC 2002 June 2002

2 2 Plan Metrology Why, what & how? Analyze NetSEC Goals Architecture Available tools Conclusion

3 3 why to measure? To know network usage To know network availability To detect dysfunction To do cost sharing Also… to improve security

4 4 What and how to measure? Qualitative: knowing its network I/O traffic load, CPU load, collision… Watch the counters of the equipments Quantitative: controlling its network Traffic type, I/O traffic load per host or group... extract information from frame analysis

5 5 Measurement to supervise Daily supervision (15 is enough ) Curves or bar graphs Always the same "look" To control and manage a network, you must visualize its behaviour

6 6 Highlighting a problem Monday April the 2nd 2001 Monday April the 9th 2001 A « normal » day May be some problems

7 7 Highlighting a problem Unfortunately! Problem discovery is a posteriori We have to go back And analyze the traffic of the involved period.

8 8 Traffic analyzing Locate the host(s) Date, addresses, intrusion method, extend of the damage… HOW? Doing crosschecking Sorting metrology data on several parameters Powerful sorting tools are needed! Powerful sorting tools are needed!

9 9 NetSEC goals To have an evolving software To analyze well-known data NetMET IPtrafic To support open standards To improve the security of networking computers

10 10 NetSEC foundations Using a relational database A simple network description A modular architecture Using an open source software

11 11 Open software Linux system (Redhat) MySQL database Apache Web server JAVA

12 12 About database JDBC database access Basic SQL queries One loader per collector

13 13 DB structure One table for one day (of data) & Date Port & protocol Volume One table for the network description

14 14 Network description A network /24 An organism University Joseph Fourier An entity CICG A location Campus of Grenoble

15 15 Available tools A data query module A graphic generator module A data mining module

16 16 Architecture Query Engine Query Process SQL Requests HTML Requests Network Description Loader Graphic Generation Process Graphic Generator Engine SQL Requests DB KDD Process Knowledge Discovery Database Engine Collector Collected Data Loader SQL Requests ALARMS REPPORTS

17 17 The query tool To use the SQL power Sort Query Extract Querying data with a friendly interface

18 18 Web interface (Question)

19 19 How does it work? Parameters processing JDBC driver loading & connection Building and executing the SQL query Displaying the results

20 20 Web interface (Answer)

21 21 Graphic generation A zoom of a network on demand. A supervision of a determined services

22 22 Graphic generation: HTTP

23 23 Functioning Database system provides data Querying database (with SQL queries) Returning results to MRTG for displaying MRTG Graphics building

24 24 Graphic generation: SSH

25 25 Data mining Produce unknown information non trivial Useful Produce association rules A and B => C

26 26 Association rules process Database Set of Transactions Data Selection Explanation Knowledge Large Itemsets Large Itemsets Research Association rules Association Rules Generation Corn flakes and sugar milk

27 27 Association rule example "] 14h-19h]" AND "SCAN/REGULAR_SERV" AND "[0-1KB]" AND 53 "TUESDAY" (14.8%, 90.4%)

28 28 Conclusion A contribution to improve security A metrology based-application Built on a database Open & Modular Who would like to participate?

29 29 TIGRE


Download ppt "NetSEC: metrology-based application for network security Jean-François SCARIOT Bernard MARTINET Centre Interuniversitaire de Calcul de Grenoble TNC 2002."

Similar presentations


Ads by Google