The continued explosion of new virus/worm and other security attacks in the Internet and the tremendous propagation speed of self-propagating attacks has led to network security being considered as a design criterion rather than an afterthought. Attack prevention, detection, and mitigation mechanisms can be broadly classified as network based or host based. Network based security mechanisms have been shown to be much more effective than host based mechanisms, primarily because of the former's ability in identifying attack traffic that is further upstream from the victim and closer to the attack source. In the context of network based mechanisms, we consider a flexible overlay network of security systems running on top of programmable (active) routers. In such an architecture, security services can be dynamically distributed across the network, which provides flexibility for load-balancing of services across nodes and addition of new services over time. Such network based mechanisms inevitably decrease network performance as all packets are analyzed for malicious content before being forwarded. In this paper, we consider traffic routing, placement of active router nodes, and distribution of security services across such nodes so as to optimize certain objectives, including (i) minimize the total number of active router deployed nodes, and (ii) minimize the maximum utilization of any router node in the network. Based on an emulation in the Deter testbed we show the benefit of the presented approach.

Abstract — The recent surge of new viruses and host attacks in the Internet and the tremendous propagation speed of selfdistributing attacks has made network security a pressing issue. To protect an end-system, it must continuously be patched and additional security tools like an Intrusion Prevention System (IPS) are needed. The main problems are the effort for the users and network performance: The last years have shown that many users neither maintain their computers nor run an IPS. Accordingly, their systems remain vulnerable. On the other hand, the operation of an IPS inevitably decreases network performance as all packets are analyzed for malicious content before being forwarded. We recently proposed the operation of a flexible overlay network of intrusion prevention systems running on top of programmable routers to mitigate these issues. With this architecture, security services can be dynamically distributed in the network. In this paper, we leverage this flexibility for minimizing the impact of intrusion prevention on network performance. Based on measurement from experiments with a prototype implementation of a programmable router, we derive an analytical description of the impact of a single active router on the network. This is then used to formulate two mixed integer optimization models for finding placement strategies for security services. Using detailed simulations on two example networks we show that the optimized strategies perform significantly better than reference placement strategies, including centralized intrusion prevention. I.

In order to fight against the increasing number of network security incidents due to mal-protected home networks permanently connected to the Internet via DSL, TV cable or similar technologies, we propose that Internet service providers (ISP) operate and manage intrusion prevention systems (IPS) which are to a large extend executed on the consumer's gateway to the Internet (e.g., DSL router). The paper analyses the requirements of ISP-operated intrusion prevention systems and presents our approach for an IPS that runs on top of an active networking environment and is automatically configured by a vulnerability scanner. We call the system FIDRAN (Flexible Intrusion Detection and Response framework for Active Networks). The system autonomously analyses the home network and correspondingly configures the IPS. Furthermore, our system detects and adjusts itself to changes in the home network (new service, new host, etc.). First performance comparisons show that our approach - while offering more flexibility and being able to support continuous updating by active networking principles - competes well with the performance of conventional intrusion prevention systems like Snort-Inline.

This paper presents a model and mechanism for flexible access control of loadable on-demand services in an active network, using code origin authentication and runtime supervision. During the development of the access control mechanism, we strongly focused on keeping the mechanism as efficient as possible, and to realize a modular design which allows to dynamically upgrade and configure the mechanism, making use of the active networking technology itself, while at the same time ensuring that mandatory security checks cannot be circumvented. Each service has to pass initial checks before it can he executed on an active node. Our approach provides access control that is dynamic, extensible and efficient, realizing a demand-driven supervision which avoids supervision of those actions that do not need to be supervised. Specific access control modules are realized as active services and activated when needed. Finally, we present results that have been achieved with a first prototype developed for the active networking platform (active multicast network) which are very promising.

Securing communication networks can no longer be ensured by singular and isolated security technologies like Internet firewalls or intrusion detection systems but rather calls for a combination of existing and emerging detection and response mechanisms, e.g. DDoS response mechanisms, anomaly detection, honey pots, etc. Today, most current systems prove to be too static to provide an adequate platform for a constructive teamwork of different security technologies. Therefore, we developed the FIDRAN framework for flexible intrusion detection and response that is based on an underlying active networking environment and that allows to dynamically combining existing and emerging security technologies. FIDRAN follows a highly modular approach that allows to extend the functionality of the framework by the integration of new security modules which are implemented as active networking services, making use of next generation networks capabilities like dynamic distribution and deployment of services on active network nodes. A further advantage of the realization of FIDRAN on top of an active networking environment is the simplification and automation of maintenance work and configuration tasks.