timbass
Tue, 10 Jul 2007 19:24:40 +0000
The afternoon sessions of InformationSecurityAsia2007 were exceptional.** Dr. Keith White, APAC Security Services Director of Alcatel-Lucent, Australia described how they partnered with Cloudshield to process security events in a distributed SEM environment.** Topics covered included edge processing, content/context based routing and event processing.** After Keith's excellent presentation I had a chance to speak with him about white-box event processing engines and strategic partnerships.
The next sessions was really interesting, highlighting*a similar*situation - the criminals are far ahead of black-box SEM processing engines; and this is readily demonstrated in the emerging*domain of extrusion detection.*** For those not familiar with this term, extrusion detection is the*network traffic inverse*of intrusion detection.** In intrusion detection systems the focus is on the detection of threats from the outside of the network, to the inside of the network.*
However, what happens when criminals implant malware, covert tunnels (for example HTTP tunnels or ICMP tunnels), and malicious bot networks inside of organizations, and the detection*challenge*shifts to detecting outbound traffic from malicious users, malware, and botnets?*** This form of criminal activity is evolving so fast that the models to detect extrusions are being formulated and tested in near*real-time.** This is where CEP can help.
Imagine a high performance, declarative programming framework that can be used to implement extrusion detection models created by experts, like the cybersecurity experts gathered together at InformationSecurityAsia2007.** On top of that,*visualize a design time studio environment that allows these same experts to graphically express their extrusion models in design time, avoiding most of the overhead of code development.** CEP and ESP engines are ripe for assisting security engineers detect the exploding commercialization of criminal extrusions, where, for example, *bot hearders can rent their botnets from $350 to $1000 USD per day.
I spoke to a number experts at InformationSecurityAsia2007 about CEP and I was*pleased to learn that they have been considering CEP and ESP engines, including open source software (i.e. Esper)*as well as*commercial offerings.*** We are considering collaborating on a new Center-of-Excellence that combines CEP/ESP engines with extrusion detection models.* Please contact me directly if you would like to participate.
We live in complex times.** Complex times require complex event processing.
More*coming from*InformationSecurityAsia2007 ....



Source...