Joint Sensor: Security Test and Evaluation Embedded in a Production Network Sensor Cloud
Tim Owen, Robert C. Scott, Roy H. Campbell · 2010
A great security posture inherently requires that cyber operations employ the latest discoveries inemerging security research to keep in step with trends in attack methodologies. The mosttrenchant cyber security research to date employs actual network data to ensure sensingalgorithms and defense methodologies are effective in real-world scenarios. This approach oftenrequires discernments to be made as temporally close to the observed events as possible to allowrapid adaptability of the security posture upon detection of an anomaly. Traditional securityarchitectures, on the other hand, are static and are managed as a centralized, homogenous,symmetrical framework of visibility and interception. Even though access to the data collectedfrom such an environment provides some accessional improvement to researching newalgorithms and detection methods, these incremental offline advancements are vetted in a sterile,non-real-time environment without the benefit of sequent responses or adaptive determinationsaccoutered by a production environment. The primary goal of the Defense Research EngineeringNetwork Cyber Security Test Bed is to leverage emerging network protocols and recentdistributed computational techniques to create a cloud of sensors built on tractable computerserver platforms that enables cutting-edge security to coexist with current security infrastructuredirectly inside the production network. The transition time of the latest cyber research fromtheory to practice will be significantly reduced while intrinsically revolutionizing the approachto engineering network security architectures. By creating a true proving ground by which thescience of new algorithms and detection methods can interact directly with raw (as opposed tofiltered, sensed, or captured) traffic in real or near-real time in a safe and controlled way, theproposed test bed will provide meaningful advances that can appreciably address the ever-changing landscape of cyber attacks.Key words: Adaptive; cloud; Defense Research and Engineering Network (DREN);detection; live; network; security; sensor; test bed.