Military Communications and Information Technology: A Trusted ...

356 Military Communications and Information Technology...
data objects. Squid handles all requests in a single, non-blocking, I/O-driven
process over IPv4 or IPv6. Squid supports SSL, extensive access controls, and full
request logging. By using the lightweight Internet Cache Protocol, Squid caches
can be arranged in a hierarchy or mesh for additional bandwidth savings. For
the project purposes it acts as an intermediary for requests from clients seeking
resources from other servers. As RE in FCDS system it is used for blocking access to
a dangerous/infected web services and informing the invoker that the page/resource
consists of harmful content.
All described RE are deployed on the edge of each protected domain. Such
solution enables total separation from other domains in extraordinary situation.
Moreover it enables immediate reaction. In more sophisticated scenario it is feasible
to place these reaction elements in front of each computer in the network.
Such solution would enable precise reaction in the case when internal terminal
within the domain is infected (eg. broadcasts spam) or the user starts unauthorized
actions. Common reaction in the federation is also possible in order to counteract
external attacks (from outside the FoS). In this case all incoming network connections
should be filtered.
It is worth noticing, that not for all detected attacks will be possible preparation
of full CDR (with reaction). In such situation experienced administrators will
be able to prepare the CDR manually and send it to RE. CDRs may be prepared
for limited time interval as well as they may be deactivated when they are obsolete.
IV. Recemmendations and future work
Presented FCDS enables information exchange between cooperating domains
and reaction against cyber attacks. In reality such cooperation requires high level
of trust between network owners. The paper describes implementation details
of FCDS system which enables security measures improvement by multi-sensor
attack detection and joint reaction. Cooperation among federated domains and
cyber information sharing is crucial to enable detection of distributed attacks.
Reliable and secure communication is required for sensor data collection, CDR
distribution and Reaction element remote control.
Future work will cover continuous development of ontology, machine learning
techniques and statistical anomaly based approach. These techniques will improve
DM capabilities in the area of precise attack detection and possible response to
minimize the attack effects. In order to provide cyber information sharing capability
with other systems FCDS must employ commonly accepted format. Some proposals
are decrscribed in [3] which should be considered in the future. Moreover, trust
management aspects shall be studied.