The Art of Digital War - [Part 3] Abstract Data Types in the Security Domain

Abstract Data Types in the Security Domain

The objective of this section is to identify the key abstract data types required to handle any type of security related data to identify the Digital Intrusions / Extrusions and take necessary remediation process to mitigate those attacks.



Handling of millions of network events (generated by Routers, Firewalls, IDS/IPS etc) per day is one of the key elements of all the Security Management solutions. Other set of information collected for processing and mining the attack pattern involves OS logs, vulnerability information of an asset, network topology, Asset Database, Identity Management systems and Application Logs. So you end up having lot of different data types. One of the biggest challenges is to normalize this information across the vendors. However, before the normalization process the key element is to identify and classify the data types.

So, let me start with two fundamental data types and let us see how these data fits into all the data sources available from different vendors and creates Digital ‘Conversations’. 

To find out more about this, read more in my blog

 Security Data Mining / Art of Digital War - Part 3

Found Dark Matter

Dark Matter which makes up 25% of the Universe finally detected. Dark matter eluded scientists for years as it doesn’t emit or reflect light. Scientists found proof of dark matter in the galaxy cluster 1E0657-556. The evidence provided by a cosmic collision between two huge clusters of galaxies. As per Maxim Markevitch of the Harvard Smithsonian Center in Cambridge, Massachusetts, it is the “most energetic cosmic show, besides the Big Bang” that we are aware of.

To find out more about this, read more in my blog Particle Physics / Found Dark Matter

Solar System with 12 Planets

IAU’s executive committee submitted (which only submits recommendations likely to get two thirds approval from the group of 2500 astronomers from 75 nations meeting in Prague to decide a universal definition of a planet) a draft proposal to expand the Solar System to 12 planets. They will have two brain storming sessions before they vote on the resolution next week (August 21-25, 2006).

The change will force the schools across the world to change their text books and the elementary school solar system models. More interestingly astrologers need to tweak their formulas to make predictions as their model of classic nine planets is not valid anymore! :-)

To find out more about this, read more in my blog Particle Physics / Solar System with 12 Planets

Sodoku Puzzle

The Sodoku puzzle is a logic game using numbers 1-9. It came to western world an year ago (2005). Read the history of this game in wikipedia.org.

The Rule: Every Column, Row and 3x3 box contains digits 1-9. No duplicates and no missing numbers.

Tips: Use logic and reasoning instead of guessing a number

To find out more about this, read more in my blog The Mind Games / Sodoku Puzzle

Rich Internet Applications

Rich Internet Applications are the next wave in User Interfaces (Google Gmail, Google RSS Reader, Google Finance etc). AJAX (Asynchronous JavaScript and XML) is a key technology in this direction. RIA’s are designed to deliver 8A’s of software simplicity. 8A’s is Bill Gates old information at your finger tips or IBM SAA (System Application Architecture). According to Gartner (Article: RIA’s are the next evolution of the web by Mark, Ray, Gene) at least 60% of the application development in 2010 will include RIA technologies and 25% in that will primarily on RIA.

Applications Able to deliver Access to Anyone Authorized Anytime, Anyplace on Any Device.

To find out more about this, read more in my blog Java and Technology / Rich Internet Applications

The Lost Gospel

Judas Iscariot a name synonymous with the word ‘traitor’. Here is the history – Judas betrayed Jesus Christ to his enemies (the Roman soldiers) for a mere 30 pieces of silver.

According to the four gospels of Mathew, Mark, Luke and John in the New Testament in which Judas is portrayed as a traitor. However, The Gospel of Judas shows that he was not only Jesus’ favorite disciple, but also that Judas betrayal was a plan between Jesus and Judas.

To find out more about this, read more in my blog The Conscious Mind / The Lost Gospel

Multi Core Mania

In December 2005 I blogged about the new set of programming languages (Metaphor and Fortress - New programming Languages) and how multi core systems could change the computing scenarios. Here is something more on multi core systems. Last week Azul systems announced a 48 way multi core chip, redefining the enterprise computing. However, the current hurdles for the Intel, Sun, IBM and other Hardware vendors with multi core CPUs will be picking the right memory technologies. "If you can't keep the cores fed fast enough from memory, you haven't gained anything," says AMD chief technology officer Phil Hester.

To find out more about this, read more in my blog Java and Technology / Multi Core Mania

The Art of Digital War - [Part 1]

The objective of this article is to identify the core issues around a digital intrusion. What are the key elements in Digital Intrusion? What is the impact on the enterprise? How do you classify the Intruders? How do you categorize your Assets?

Latest CERT reports a total of 5990[1] vulnerabilities for the year 2005 an increase of 58.5% from the year 2004 and a 3402% increase from the year 1995. Usually vulnerability in an application is due to un-identified bug in the code. However there are times when backdoors written explicitly in some application to get into a users machine.

To find out more about this, read more in my blog Security Datamining / The Art of Digital War

---

[1] 2005 Vulnerability List http://www.cert.org/stats/cert_stats.html

Virus / Worm Behavior Analysis

Viruses of the new era posses attack models, similar to a sophisticated Hacker (or Cracker). It scans your network, exploits your vulnerable applications, creates backdoors for control, and does DoS (Denial of Service) attacks against other systems and even fights other viruses and worms to show supremacy!

Its time to re-look at these Malwares from a completely different perspective to contain and prevent these Malwares from attacking your networks and other critical assets.

To find out more about this, read more in my blog Security Datamining / Virus and Worm Behavior Analysis

The Art of Digital War - [Part 2] Alarms in Intrusion Detection Systems

The following table shows a set of words and its frequency.

Word	Frequency		Word	Frequency		Word	Frequency
The	1101		I	561		In	414
And	878		You	544		It	414
To	726		My	508		That	389
Of	657		A	498		….	…..

I know you must be wondering about, frequency related to what? That’s the key!

To find out more about this, read more in my blog Security Datamining / Alarms in Intrusion Detection Systems