1Towards trapping wily intruders in the large

The rapid increase in network bandwidth from mega bits per second to giga bits per second and potentially to tera bits per second, is making it increasingly difficult to carry out in a timely and accurate manner, the analysis required to detect network abusers. The problem is made even more difficult with the devious techniques (e.g. spoofing) used by the hackers. Intrusions are in general preceded by some noise or indication of the intruder groping for a door, trying (unsuccessfully) a key etc. In the network context these signals may be seen in the TCP-RESET packets and the ICMP echo-response or destination/port unreachable packets. But neither all TCP-RESETS nor all ICMP packets are indicative of attempted intrusions. Analysis of network traffic has shown that the profiles of such TCP-RESETs due to intrusion attempts are distinctly different from those due unintentional mistakes. The same profiling can be carried out for ICMP unreachable packets to detect attempts at intrusion. By monitoring such suspicious signals in a distributed information collection framework intrusions or attempts thereof can be effectively detected. To counter the threats posed by spoofing, a new technique based on packet flow monitoring is introduced. The flow patterns can be traced across networks to track an intruder. For this purpose we have developed an SNMP based messaging system which allows “friendly ” networks to collaborate in tracking down the intruder. Results using prototype implementations on a medium size operational network are presented. The rapid increase in network bandwidth from mega bits per second to giga bits per second and potentially to tera bits per second, is making it increasingly difficult to carry out in a timely and accurate manner, the analysis required to detect network abusers. The problem is made even more difficult with the devious techniques (e.g. spoofing) used by th