Skip to main content

Sensor placement evaluation

I'm back again with an article discussing optimal network sensor placement. It is a simple case study i made after i've finished my thesis (APT detection through machine learning and network behavior analysis) regarding the network sensor placement in order to achieve maximum network visibility with minimal possible redundancy. These days i read "Network Security Through Data Analysis, Michael Collins, 2014" which triggered this case study.

The experimental network is a prototype enterprise network depicted in the following image.

(I didn't take it from "The Practice of Network Security Monitoring, Richard Bejtlich, 2013" even if it is almost the same with one of Richard Bejtlich's images. It is created using Dia)

The above network is a reasonable abstraction of an enterprise one. So in the following picture i try to place the candidate sensor positions (From A to F) and replace DMZ with a Debian machine (running an FTP, HTTP and SSH server) and Internal Network with a Windows machine. Also in point F there exist three service sensors (one for every service) and both server and client have the OSSEC client installed (the monitor computer is the server of the OSSEC distributed architecture and the one that monitors the traffic in every network-based sensor).




The next step contains the attentive creation of the worksheet showing the vantage of the last picture.


So from this table we conclude that:
  1. Host-based sensors are necessary for every connected machine. The advantage of host-based sensors is that they can monitor logins, logouts, file accesses etc. Nonetheless, you can implement host-based sensors only on hosts that you know about their existence in the network.
  2. Regarding service-based sensors, it is recommended that we place one sensor for every service our server runs so as to view traffic related to these services.
  3. Points A and B has the same vantage.
  4. From points B, C and E in order to achieve minimal redundancy with maximum visibility we should choose whichever two points, applying some kind of filter in one them. In my opinion, network-based sensors at points C and E satisfy most of our needs. This is true because in case of applying NAT in our two networks (DMZ of Internal Network) sensors in points C and E are capable of distinguishing different IP addresses.
The filter i suggest that you apply is the one that gives the following table (appropriately filtering the sensor in point E).

After this process we extract the desired table which is the one that gives the best results.


That's all! Try applying the same process in an experimental network and come back with your comments... Have a nice day...

Comments

Popular posts from this blog

Hi folks!

Eventually, after some brainstorming conversations with Kostas we decided to create this blog in order to post our work.

As you may guess my name is Anastasios. My interests are comprised of computer security, linux, operating systems and many more low level programming concepts :P.

Finally and before my first post, I would like to thank Kostas for taking care of junkbytes.com because i wasn't involved in the creation process. May the source be with you Kostas :) .

So regarding my first post, last days i encountered a very interesting way to execute ptrace. What is ptrace system call ?

ptrace is a system call found in several Unix and Unix-like operating systems. By using ptrace (the name is an abbreviation of "process trace") one process can control another, enabling the controller to inspect and manipulate the internal state of its target. ptrace is used by debuggers and other code-analysis tools, mostly as aids to software development. (wikipedia.org)

As you can see i…

Revisiting "Stick Soldiers"

Update 16 Sep 2016: The project mentioned in this post has its own page on Gamejolt and Itch.io now: Visit "Stick Veterans" on Gamejolt or Itch.io for more info.
Some of you may have played the classic games Stick Soldiers 1 and 2 by WhiteSpaceUnlimited. Stick Soldiers belongs to the list of small, humble games that manage to captivate our interest and have made many of us spend a lot of our free time and have a lot of fun. (you can download them here: SS1, SS2)

Stick Soldiers has remained discontinued for the past years after the hiatus of the development team and the cancellation of the long-awaited sequel Stick Soldiers 3 by Andrew Russell Studios.

For a long time, I have aspired to revive the Stick Soldiers series by making a fan sequel to the game. Since school's start, I spent about a whole year working on a Game Maker / Ultimate3D project, aiming to evolve it to a complete and worthy sequel, which I called "Stick Soldiers: Encore". Second year of school …

Digital Forensics: Imaging

Hello! Sorry for being inactive so much time but summer lasted a little bit longer than usual..!

Regarding my digging in digital forensics, i decided to create a series of posts beginning with imaging. So today i will show you the three most prevalent formats of "post-mortem" imaging and how to obtain them (on a *nix system) from a test disk.

The discussed formats are the following:
(1) Raw Format
(2) Expert Witness Compression Format (or ewf)
(3) Advanced Forensic Format (or aff)