Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
351
and carries the following information: categorized source called facility, severity
(from debug to emergency), host or interface name, timestamp and message
(unstandardized description of event). Syslog supports hierarchical network architecture.
Lack of reliable transfer of events from Sensors to local Decision Modules
was unacceptable in SOPAS; thus decision about using Syslog-ng [7] implementation
which support transport using TCP was made. To make the communication
secure, a built in TLS mechanism based on X.509 certificates provides encryption
and mutual authentication between the host and the server.
B. Decision Module
Each DM is responsible for acquiring and processing network events coming
from sensors distributed over the domain. If the attack or its symptoms are detected
in one domain, the relevant information are disseminated to other cooperating
domains so that appropriate countermeasures can be applied.
Decision module in the proposed federated system is responsible for correlating
network events in order to detect and recognize malicious events in the network.
DM consists of the following components [10]:
• Correlation Engine (e.g. based on the Borealis system),
• CLIPS rule engine,
• Ontology (in OWL format),
• Graphical User Interface.
The Decision Module components are presented in Figure 2, while the UML
diagram is shown in Figure 3.
Figure 2. Decision Module architecture and components [10]
Borealis is a distributed stream processing engine and is responsible for
gathering information generated by the network sensors [11]. Correlation engine