A contract-based event-driven model for cooperative environments: the case of collaborative security

The subjects of this kind of attack are the web servers handling the external web connectivity of the participating FIs. Those web servers typically run outside the corporate firewall (in DMZ), and are therefore frequently targeted by the attackers. The goal of the attack is to identify TCP ports that might have been left opened at the attacked subjects. The attack is carried out by initiating a series of TCP connections to ranges of ports at each of the targeted DMZ servers. The ports that are detected as opened can be used as the intrusion vectors at a later time. The attack detection is based on identifying patterns of unusually high number of TCP SYN requests possibly targeting an unusually high number of ports, and originating from the same external IP address. Such a detection relies on some thresholds, that set the maximum number of requests which can be issued before being classified as a malicious source. The problem that arises concerns that these requests are spread by the attacker on several target hosts so that those threshold are never exceeded. Here the collaboration comes into play. In fact the statistics are collected and analyzed across the entire set of the ID-SR participants, thus improving chances of identifying low volume activities, which would have gone undetected if the individual participants were exclusively relying on their local protection systems. In addition, to minimize the amount of false positives, the real-time suspicions are periodically calibrated through a reputation system which maintains the site ranking based on the past history of the malicious activities originating from those sites.