Made available in DSpace on 2016-08-17T14:53:20Z (GMT). No. of bitstreams: 1 dissertacao Ariel Soares.pdf: 2676523 bytes, checksum: 253ad7139526979b18118267bd40d607 (MD5) Previous issue date: 2012-03-21 / FUNDAÇÃO DE AMPARO À PESQUISA E AO DESENVOLVIMENTO CIENTIFICO E TECNOLÓGICO DO MARANHÃO / Security in computer networks is the area responsible for protecting the data passing through it. The research for better security strategies has increased considerably since exists a vast number of attempted attacks. These attacks have caused financial loss and reputation damage to companies, institutions and individuals. There are several obstacles to achieve security into networks and it led to increase the problem complexity of security management. For this reason, it is interesting using the resources offered by Autonomic Computing (AC). AC systems are capable of manage themselves and to adapt dynamically to changes in order to restore its balance according to policies and business goals. The architecture and properties of AC to implement systems offers many advantages to be applied to network security. In this work, we present the concepts of AC and demonstrate its applicability on the network computer security context. The AC concepts application in network security introduces the auto-security capability to the system. To show the feasibility of achieving auto-security, we developed and present an autonomic mechanism for network protection. This mechanism is represented, initially, by an autonomic framework, which is organized according to MAPE-K model. In this model, autonomic managers perform the sensing activities on the execution environment, context analysis, planning and execution of dynamic reconfiguration actions. Then, we implemented two autonomic cycles. The first cycle aims to generate firewall rules based on honeypots log files. The second cycle is responsible for manipulate, dynamically, virtual honeypots that are classified as compromised. The results show that it is possible to obtain integration and cooperation between security systems; intelligence, through the deployment of autonomic strategies that turn the protection process dynamic; and autonomy, to achieve self-security on the network. / Segurança em redes de computadores compreende a área responsável pela proteção dos dados que a transitam. A busca por melhores estratégias de segurança tem aumentado consideravelmente, tendo em vista a grande quantidade de tentativas de ataques que vem sendo realizados. Esses ataques tem causado prejuízos financeiros e de imagem para empresas, instituições e pessoas físicas. Vários obstáculos a serem enfrentados para se alcançar redes realmente seguras existem e isso eleva a complexidade do problema da gerência de segurança. Por esse motivo é interessante a utilização de recursos oferecidos pela Computação Autonômica (CA). Sistemas de CA são capazes de gerenciarem a si próprios e se adaptarem dinamicamente às mudanças a fim de restabelecer seu equilíbrio de acordo com as políticas e os objetivos de negócio. A arquitetura e as propriedades de CA para a implementação de sistemas propõe uma abordagem com muitas vantagens para ser aplicada à segurança de redes. Neste trabalho, apresentamos os conceitos de CA e mostramos sua aplicabilidade ao contexto de segurança em redes de computadores. A aplicação dos conceitos de CA à segurança de redes introduz no sistema a capacidade de auto-segurança. Para mostrar a viabilidade em conseguir auto-segurança, desenvolvemos e apresentamos um mecanismo autonômico para segurança de redes. Este mecanismo é representado, inicialmente, por um framework autonômico, no qual é organizado seguindo o modelo MAPE-K. Neste modelo gerentes autonômicos realizam as atividades de sensoriamento do ambiente de execução, análise de contexto, planejamento e execução de ações de reconfiguração dinâmica. Em seguida, implementamos dois ciclos autonômicos. O primeiro tem a funcionalidade de gerar regras de firewall baseadas em logs de honeypots. O segundo ciclo é responsável por manipular dinamicamente honeypots virtuais que são considerados comprometidos. Os resultados mostram que é possível obter integração e cooperação entre os sistemas de segurança; inteligência, através da implantação de estratégias autonômicas que dinamizam o processo de proteção; e autonomia, para alcançar autossegurança na rede.

Client-side computers connected to the Internet today are exposed to a lot malicious activity. Browsing the web can easily result in malware infection even if the user only visits well known and trusted sites. Attackers use website vulnerabilities and ad-networks to expose their malicious code to a large user base. The continuing trend of the attackers seems to be botnet construction that collects large amounts of data which could be a serious threat to company secrets and personal integrity. Meanwhile security researches are using a technology known as honeypots/honeyclients to find and analyze new malware. This thesis takes the concept of honeyclients and combines it with a proxy and database software to construct a new kind of real time defense mechanism usable in live environments. The concept is given the name Honeyscout and it analyzes any content before it reaches the user by using visited sites as a starting point for further crawling, blacklisting any malicious content found. A proof-of-concept honeyscout has been developed using the honeyclient Monkey-Spider by Ali Ikinci as a base. Results from the evaluation shows that the concept has potential as an effective and user-friendly defense technology. There are however large needs to further optimize and speed up the crawling process.

Cloud services have grown very quickly over the past couple of years, giving consumers and companies the chance to put services, resources and infrastructures in the hands of a provider. Therefore removing the need of providing these services themselves. This can for example lead to cost savings, better resource utilization and removing the need of technical expertise for the customers. There is big security concerns when using cloud services. Security is very important in cloud computing since people and companies store confidential data in the cloud. It must also be easy to use the services provided, since cloud services have so many users with different technical background. Since the control of services and data needed for the everyday-run of a corporation is being handled by another company, further issues needs to be concerned. The consumer needs to trust the provider, and know that they handle their data in a correct manner, and that resources can be accessed when needed. This thesis focuses on authentication and transmission encryption in cloud services. The current solutions used today to login to cloud services have been investigated and concluded that they don't satisfy the needs for cloud services. They are either insecure, complex or costly. It can also be concluded that the best encryption algorithm to use in a cloud environment is RC4, which is secure and at the same time a fast algorithm. Compared to AES, which together with RC4, are the most common encryption methods used over the Internet today, RC4 is the better choice. This thesis have resulted in an authentication and registration method that is both secure and easy to use, therefore fulfilling the needs of cloud service authentication. The method have been implemented in a fully working finished solution, that use a regular mobile phone to generate one time passwords that is used to login to cloud services. All of the data transmissions between the client and the server have been configured to use RC4 encryption. The conclusions that can be drawn is that the security proposal implemented in this thesis work functions very well, and provide good security together with an ease of use for clients that don't have so much technical knowledge.

Covert Channels have existed for more than twenty years now. Although they did not receive a special attention in their early years, they are being more and more studied nowadays. This work focuses on network covert channels and it attempts to give an overview on their basics to later analyse several existing implementations which may compromise the security perimeter of a corporate network. The features under study are the bandwidth provided by the channel and the ease of detection. The studied tools have turned out to be in most cases unreliable and easy to detect with current detection techniques and the bandwidth provided is usually moderate but they might pose a threat if not taken into consideration.

In nature, it is inspiring to observe such an extensive variety of defensive skills distributed among species. The speed of an antelope, and the sting of a scorpion, wasp or a bee are some examples of such defensive tools or mechanisms important to survive against predators. However sophisticated the skills or tools are, the correct accurate use and on-time triggering of those tools is a matter of life and death for animals. With those defensive measures, animals come with a complementary ability called "vigilance". Vigilance is costly and the human tries to minimize vigilant behaviour in every aspect of life. The absence of vigilance, or negligence in other words, allows humans to spend more time and cognition on matters that he or she wants rather than on problems that need time. The human has an inherent and intricate mechanism that determine the vigilance level required for a particular problem. The consequences of the lack of vigilance in a work environment, more especially in the Information Technologies Security field are catastrophic and even lethal as humanity becomes an increasingly associated habitant of cyberspace ecosystem. Intrusion Execution Systems (IES) which is one of my conceptual propositions in this research, is my approach to reduce negligent behaviour in IT Security personnel. Impetus is the name of the first prototype for IES concept with limitations, which is included in this research. Impetus can successfully achieve desired behaviour in test environment, however the conceptual propositions in this research among with Impetus, should further be experimented in real-world in order to be convinced of its effectiveness.

Survival Time, what exactly does the term imply and what is the best method to measure it? Several experts within the field of Internet security have used the term; some has gone further and presented statistical facts on the survival time throughout the years. This bachelor thesis aim to present a universal definition of the term and further on measure the current survival time for a given unprotected system. By the deployment of a decoy, data will be captured and collected through port monitoring. Mainly focus will lie on building a time curve presenting the estimated time for an unprotected public system to get detected on the Internet and the elapsed time hence the system gets attacked.

Att skydda sin IT-miljö mot olika typer av intrång och attacker som till exempel trojaner,skadliga Java applets eller DoS attacker med hjälp av brandväggar och antivirusprogramär två viktiga lager i skalskyddet. I den här uppsatsen undersöks hur väl ett Intrusion Prevention System skulle kunna fungera som ett ytterligare lager i skalskyddet. Fokus ligger på hur väl IPS-systemet klarar av att avvärja attacker, hur mycket tid som går åt till konfigurering och drift för att få ett fungerande IPS samt hur prestandan i nätverket påverkas av implementationen. För att mäta hur väl IPS systemet klarar av att upptäcka och blockera attacker utförs två experiment där ett mindre nätverk attackeras på olika sätt. I det första experimentet skyddas infrastrukturen av en brandvägg och klienterna är utrustade med antivirusprogram. I det andra experimentet genomförs samma attacker igen fast med ett Snort IPS implementerat i nätverket. Resultatet av de genomförda experimenten visar att en IPS klarar att blockera ca 87% av attackerna, men nätverksprestandan påverkas negativt. Slutsatsen är att endast brandväggar och antivirusprogram inte ger ett fullgott skydd.

Ces dernières années, la sécurité est devenue un défi dans les réseaux informatiques. Les logiciels anti-virus, les pare-feu et les systèmes de détection d'intrusion ne suffisent pas à empêcher les attaques sophistiquées fabriquées par plusieurs utilisateurs. Les réseaux informatiques de grille sont souvent composés de différents domaines administratifs appartenant à différentes organisations. Chaque domaine peut avoir sa propre politique de sécurité et ne pas vouloir partager ses données de sécurité avec des réseaux moins protégés. Il est donc plus complexe d'assurer la sécurité de ces réseaux et de les protéger des attaques interdomaines. La principale difficulté est de traiter la nature distinctive de l'infrastructure du réseau, à savoir: les réseaux multi-sites, les domaines multi-administratifs, la collaboration dynamique entre les nœuds et les sites, le nombre élevé de nœuds à gérer, l'absence de vue claire des réseaux externes et l'échange d'informations de sécurité entre différents domaines administratifs. Pour gérer les problèmes mentionnés ci-dessus, je propose un Security Event Manager (SEM) appelé Grid Security Operation Center (GSOC). GSOC peut aider les responsables de la sécurité informatique à donner une vision de la sécurité de l'ensemble du réseau sans compromettre la confidentialité des données de sécurité. Pour ce faire, GSOC fournit une évaluation de sécurité de chaque domaine administratif (AD) en fonction du nombre d'alertes de sécurité signalées. Il y a trois niveaux de sécurité définis: le niveau 1 est le plus sécurisé, le niveau 2 est le plus sécurisé et le niveau 3 est le moins sécurisé. Cette classification aide à identifier les AD qui sont sous les attaques ou les AD qui sont à haut risque d'être attaqué à l'avenir. Un mécanisme de corrélation en deux temps est proposé, ce qui réduit les alertes de sécurité et continue à détecter les attaques dans le cadre d'attaques distribuées intensives. Un schéma de partage d'alertes de sécurité paramétrique a été introduit. Les alertes de sécurité peuvent être partagées à tout moment entre les membres du réseau informatique. Ce partage d'alertes informe les membres participants à voir les attaques en cours dans les autres locaux des AD sans interférer dans la politique de sécurité. Ce concept de partage d'alertes de sécurité a été discuté dans le passé mais n'a jamais été mis en œuvre. GSOC est la première mise en œuvre de cette idée à la fine pointe de la technologie. Ce partage d'alertes permet de bloquer la propagation des réseaux inter-domaines dans les réseaux informatiques de grille. / In recent years security is becoming a challenge in grid computing networks. Anti-virus softwares, firewalls and intrusion detection systems are not enough to prevent sophisticated attacks fabricated by multiple users. Grid computing networks are often composed of different administrative domains owned by different organizations. Each domain can have its own security policy and may not want to share its security data with less protected networks. It is therefore more complex to ensure the security of such networks and to protect them from cross-domain attacks. The main difficulty is to deal with the distinguish nature of grid infrastructure, that are: multi-sites networks, multi-administrative domains, dynamic collaboration between nodes and sites, high number of nodes to manage, no clear view of the external networks and exchange of security information among different administrative domains. To handle the above mentioned issues, I am proposing a Security Event Manager (SEM) called Grid Security Operation Center (GSOC). GSOC can assist IT security managers in giving a view of the security of the whole grid network without compromising confidentiality of security data. To do so, GSOC provides a security evaluation of each administrative domain (AD) depending on the number of security alerts reported. There are three security levels defined as level 1 is the most secure, level 2 is the more secure and level 3 is the least secure. This classification helps to identify the ADs that are under attacks or the ADs that are at high risk of being attacked in future. A two step time based correlation mechanism is proposed which reduces the security alerts and continue detecting attacks under intense distributed attacks. A parametric security alerts sharing scheme has been introduced. Security alerts can be shared at any time between the members of the grid computing network. This alert sharing informs the participating members to see the ongoing attacks on the other premises of the ADs without interfering in the security policy. This security alert sharing concept has been discussed in past but never implemented. GSOC is the first state of the art implementation of this idea. This alert sharing helps in blocking the propagation of cross-domain networks in grid computing networks.

This work describes honeypots, their definition, clasification and logging possibilities. In the practical part honeypots are tested for the services that are most often attacked, their installation is performed and tests are made for basic familiarization with the functionality of the honeypot. Furthermore, the honeypot is exposed to the Internet and the obtained data are analyzed.

This diploma thesis deals with the evaluation of a security solution that was recently deployed by a British company renting office space. This validation system is based on a database of MAC addresses, a database of clients and active filtering of connected devices. The first part explains the concepts of computer network, VLAN and basic concepts needed to understand the function of dynamic assignment of VLAN and IP addresses. The second part is devoted to measurements based on hypotheses, according to which measures are proposed in the last part to solve these security problems.