REFACING: An autonomic approach to network security based on multidimensional trustworthiness

Abstract

Several research efforts have recently focused on achieving distributed anomaly detection in an effective way. As a result, new information fusion algorithms and models have been defined and applied in order to correlate information from multiple intrusion detection sensors distributed inside the network. In this field, an approach which is gaining momentum in the international research community relies on the exploitation of the Dempster–Shafer (D–S) theory. Dempster and Shafer have conceived a mathematical theory of evidence based on belief functions and plausible reasoning, which is used to combine separate pieces of information (evidence) to compute the probability of an event.

However, the adoption of the D–S theory to improve distributed anomaly detection efficiency generally involves facing some important issues. The most important challenge definitely consists in sorting the uncertainties in the problem into a priori independent items of evidence. We believe that this can be effectively carried out by looking at some of the principles of autonomic computing in a self-adaptive fashion, i.e. by introducing support for self-management, self-configuration and self-optimization functionality.

In this paper, we intend to tackle some of the above mentioned issues by proposing the application of the D–S theory to network information fusion. This will be done by proposing a model for a self-management supervising layer exploiting the innovative concept of multidimensional reputation, which we have called REFACING (RElationship–FAmiliarity–Confidence–INteGrity).

Introduction

As computer attacks become more and more sophisticated, the need to provide effective intrusion detection methods increases. Current best practices for protecting networks from malicious attacks rely on the deployment of an infrastructure that includes network intrusion detection systems. However, most such practices suffer from several deficiencies, like the inability to detect distributed or coordinated attacks and the high false alarm rates. Indeed, detecting intrusions becomes a hard task in any networked environment, since a network naturally lends itself to a distributed exploitation of its resources. In such a scenario, the identification of a potential attack requires that information is gathered from many different sources and in many different places, since no locality principle (neither spatial nor temporal) can be fruitfully applied in the most general case.

The classical approaches to distributed protection of a network rely on the effective dissemination of probes and classifiers/analyzers across the infrastructure.

We claim that the current solutions to the above mentioned issues lack two fundamental features, namely variability and trustworthiness. Indeed, in our view a network should be capable to self-protect against attacks by means of an autonomic approach which highly depends on the effective exploitation, in each node, of on-line information coming both from local analysis of traffic and from synthetic information delivered by neighboring nodes. Self-organization demands for an un-coordinated capability to appropriately orchestrate the behavior of a number of distributed components. Besides this, the second challenge we identify resides in the need for having an agreed-upon means of deciding whether or not information coming from the outside world can be assumed to be reliable.

In this paper, we discuss the main issues related to improving network security through manipulating and combining data coming from multiple sources. To this regard, we start in Section 2 with an analysis of the state of the art in the field of information fusion with a special focus on distributed intrusion detection. In the same section, we devote particular attention to the Dempster and Shafer’s approach [1], [2], which is quite well-known in the international research community thanks to the so-called theory of evidence. In Section 3, we introduce the basic principles on which lays the autonomic communication paradigm; this is preparatory to the heart of the paper, whose main contribution comes in the subsequent section. More precisely, we discuss in Section 4 a model for a self-management supervising layer exploiting the innovative concept of multidimensional reputation. A thorough performance evaluation of the proposed model is conducted in Section 5. Section 6 proposes a survey of works which have some points in common with our approach, since they exploit the two main features of our solution, namely cooperation and reputation-based information sharing. Conclusions are provided in Section 7.