CAIS Sensor: Distributed Sensors Network in Brazilian NREN LACSEC - PowerPoint PPT Presentation

CAIS Sensor: Distributed Sensors Network in Brazilian NREN LACSEC LACNIC27

Regarding RNP • Brazilian National Research and Education Network (RNP). • Created in 1989. • Implementing the first Latin American fiber network in 2005.

Regarding CAIS • Coordination CSIRT of Brazilian research and education network since 1997. • CAIS works in detection, resolution and prevention of network security incidents. Security Security CSIRT Security Vulnerability Incident Development Awareness Management Handling

Motivations to create a CAIS Sensor network Rede Ipê, Brazilian academic network backbone. Built-in capacity of 347 Gbps Interconnects 1.911 units of RNP's Customers (Universities, Federal Institutes, Research Organizations). Highly diversified environment, regarding networks, technologies and maturity of customers’ security teams. Difficulties for efficient detection. * dados de 2015

CAIS Sensor Requirements

What is the CAIS Sensor?

How does CAIS Sensor analyze traffic?

How does CAIS Sensor work? Master Server Sensor (Suricata) + + Query Engine Engine Engine (Suricata) (Suricata) (Suricata)

What does Master Server do? • Sensor management • Sensor’s system updates Master management • Statistics of malicious activities detected • Information about sensor’s Engines(Suricata) “health” • System general administration

Regarding Engines(Suricata) • Engines(Suricata) Friendly user interface • Plug and play • Less technical knowledge required • Low maintenance and support • Send detections by email • Send statistics and status data • Update requests

The CAIS Sensor(Screenshots) Main menu Quick Information Quick access dashboard tasks

The CAIS Sensor(Screenshots )

Engine(Screenshots) – Installation Menu • Network interface configuration. • Select network pickup interface. • Restart Services. • Use license configuration.

CAIS Sensor Implementation 27 RNP Points of Presence 17 Customers 44 Sensors Installed

Statistics – Average Analyzed Traffic

Statistics Most attacked ports Malicious activity flow 9% 91% Incoming Outgoing

Statistics - Main types of malicious activity detected DDoS Attempts(protocol xdmcp) 702.345 DDoS Attack (protocol NTP) 535.204 Malwares 236.985 DDoS Attack (protocol SNMP) 102.478

Statistics – Types of detected events

Statistics - Botnets XcodeGhost nicaze.net Zeus Kelihos PCRat/Gh0st Bladabindi/njrat Feodo Palevo Beacon DealPly

Next Steps • Optimize reports • Integrate with other sources (URLs blacklist, IPs blacklist, others) • Increase number of sensors in educational institutions and RNP customers • Finalize and expand the partnership model

Questions ?

Thanks! RNP – Brazilian Educational and Research Network CAIS – RNP Incident Security Response Team Rildo Souza Yuri Alexandro Security Analyst Security Analyst rildo.souza@rnp.br yuri.ferreira@rnp.br

CAIS Sensor: Distributed Sensors Network in Brazilian NREN LACSEC - PowerPoint PPT Presentation

CAIS Sensor: Distributed Sensors Network in Brazilian NREN LACSEC LACNIC27 Regarding RNP Brazilian National Research and Education Network (RNP). Created in 1989. Implementing the first Latin American fiber network in 2005.

Security in Wireless Sensor Networks Introduction A Wireless Sensor Network is a network made of

Distributed Algorithms for Guiding Navigation across a Sensor Network Qun Li Michael de Rosa

Developing CSIRTs in Brazilian NREN RNP Mission: To promote the innovative use of advanced

Smart Sensor in Wide Area Network Environment How can sensors improve your safety? Tadeusz

Problem Formulation: Distributed Action Recognition Architecture Eight sensors on human body.

Distributed Fusion in Sensor Distributed Fusion in Sensor Networks Networks Jie Gao Computer

A distributed approximation scheme for sleep scheduling in sensor networks Patrik Flor een,

A distributed approximation scheme for sleep scheduling in sensor networks Patrik Flor een,

a SENSOR OVERVIEW I Sensors: Convert a Signal or Stimulus (Representing a Physical Property)

CAIS O Frequency R esponse S tudy S takeholder Conference GE E nergy CAIS O Nicholas W.

CS378 - Mobile Computing Sensing and Sensors Part 2 Using Sensors Recall basics for using a

Real-Time Monitoring Sensors Rain Gauge Sensors: Water Level Sensors: Other Sensors:

Acoustic Monitoring using Wireless Sensor Networks Presented by: Farhan Imtiaz Seminar in

Sensors CS 4720 Mobile Application Development CS 4720 Sensor Categories Android

Data for Official Statistics Marco Puts, Piet Daas, Martijn Tennekes Road sensors Road sensor

PAST : Probabilistic Authentication of Sensor Timestamps Ashish Gehani SRI 1 INTRODUCTION :

Fuzzing Filesystems on NetBSD via AFL+KCOV Maciej Grochowski Maciej.Grochowski[at]protonmail.com

Classification of URL Bitstreams using Bag of Bytes Keiichi Shima & Hiroshi Abe (IIJ

Detecting Hardware Trojans: A Tale of Two Techniques Sharad Malik sharad@princeton.edu FMCAD

CSCI 4250/6250 Fall 2015 Computer and Networks Security Network Security Goodrich, Chapter

GPU on OpenStack Masafumi Ohta @masafumiohta Who am I > Working for System Integrator as

Location tracking Location tracking Engineering & Public Policy Lorrie Faith Cranor

Detection of browser-based cryptocurrency mining Veelasha Moonsamy Radboud University, The

Pattern Selection using CEGAR Alexander Rovner University of Basel July 31, 2018 Background

CAIS Sensor: Distributed Sensors Network in Brazilian NREN LACSEC - PowerPoint PPT Presentation

CAIS Sensor: Distributed Sensors Network in Brazilian NREN LACSEC LACNIC27 Regarding RNP Brazilian National Research and Education Network (RNP). Created in 1989. Implementing the first Latin American fiber network in 2005.

Security in Wireless Sensor Networks Introduction A Wireless Sensor Network is a network made of

Distributed Algorithms for Guiding Navigation across a Sensor Network Qun Li Michael de Rosa

Developing CSIRTs in Brazilian NREN RNP Mission: To promote the innovative use of advanced

Smart Sensor in Wide Area Network Environment How can sensors improve your safety? Tadeusz

Problem Formulation: Distributed Action Recognition Architecture Eight sensors on human body.

Distributed Fusion in Sensor Distributed Fusion in Sensor Networks Networks Jie Gao Computer

A distributed approximation scheme for sleep scheduling in sensor networks Patrik Flor een,

A distributed approximation scheme for sleep scheduling in sensor networks Patrik Flor een,

a SENSOR OVERVIEW I Sensors: Convert a Signal or Stimulus (Representing a Physical Property)

CAIS O Frequency R esponse S tudy S takeholder Conference GE E nergy CAIS O Nicholas W.

CS378 - Mobile Computing Sensing and Sensors Part 2 Using Sensors Recall basics for using a

Real-Time Monitoring Sensors Rain Gauge Sensors: Water Level Sensors: Other Sensors:

Acoustic Monitoring using Wireless Sensor Networks Presented by: Farhan Imtiaz Seminar in

Sensors CS 4720 Mobile Application Development CS 4720 Sensor Categories Android

Data for Official Statistics Marco Puts, Piet Daas, Martijn Tennekes Road sensors Road sensor

PAST : Probabilistic Authentication of Sensor Timestamps Ashish Gehani SRI 1 INTRODUCTION :

Fuzzing Filesystems on NetBSD via AFL+KCOV Maciej Grochowski Maciej.Grochowski[at]protonmail.com

Classification of URL Bitstreams using Bag of Bytes Keiichi Shima &amp; Hiroshi Abe (IIJ

Detecting Hardware Trojans: A Tale of Two Techniques Sharad Malik sharad@princeton.edu FMCAD

CSCI 4250/6250 Fall 2015 Computer and Networks Security Network Security Goodrich, Chapter

GPU on OpenStack Masafumi Ohta @masafumiohta Who am I &gt; Working for System Integrator as

Location tracking Location tracking Engineering &amp; Public Policy Lorrie Faith Cranor

Detection of browser-based cryptocurrency mining Veelasha Moonsamy Radboud University, The

Pattern Selection using CEGAR Alexander Rovner University of Basel July 31, 2018 Background

Classification of URL Bitstreams using Bag of Bytes Keiichi Shima & Hiroshi Abe (IIJ

GPU on OpenStack Masafumi Ohta @masafumiohta Who am I > Working for System Integrator as

Location tracking Location tracking Engineering & Public Policy Lorrie Faith Cranor