ForNet: A Distributed Forensic Network

The Internet was created using simple rules to serve the communication needs of a well-defined community. In the past decade, however, it has transformed itself to accommodate a much wider and more varied community of users and services. We also learned that Internet is vulnerable to attacks and misuse. In order to mitigate these threats many defensive mechanisms, such as firewalls and intrusion detection systems, are currently incorporated into networks. Despite these defenses we still witness many incidents every month that disrupts routine network operations. Lack of attribution mechanisms in networks provides an excellent cloak to perpetrators to remain anonymous before, during, and after the attacks. Most often we are not only unable to defend our network against attacks but also unable to identify the source of attacks. In order to guarantee the safety and survivability of networks we must complement the defense mechanisms with capabilities to track-and-trace attacks or misuses. Reasons for the absence of a monitoring mechanism in networks are two fold. The first, technical difficulties in handling large volume of data on wide area networks and storing the data for prolonged periods of time. The second, until recently there were no economic incentives for network operators to deploy and maintain such a system. Most networks currently use intrusion detection systems (IDS) to also “monitor” their networks. IDS do not monitor all network activities but only a subset of activities defined a priori. The a priori definition narrows the monitoring field and limits its use for track-and-trace of novel attacks. For example, an IDS cannot be used to find out which hosts received a copy of a fast spreading worm. This is because worms spread faster than we can update IDS signatures. Since the signature was not available during the worm’s initial spread IDS would not have kept historical data necessary to trace the possible victims. Another approach to monitoring is to augment networks with packet-loggers. Packet-loggers require large storage capacity to store raw network data and put economical and maintenance burdens on network operators and are not widely deployed. Further, these systems cannot share collected data, therefore are not effective in many cases. Also they do not have explicit support for user privacy. Therefore, the cost-benefit ratio is not in favor of network operators to deploy and maintain such a system. We believe, the lack of monitoring mechanisms in networks can no longer be ignored and this is the right time to explore this problem space actively. Recent advances in streaming algorithms [1], storage capacity, and computing power provides us the necessary tools to handle large volume of data. In addition, recent increase in cybercrimes and litigation where network operators are held liable for damages create the much needed economic incentives. The availability of right tools and the need for track-and-trace capabilities together will act as catalysts in fostering research and development in this area. In the rest of this paper we present our approach to addressing the issues, called ForNet.