DataSoft/Nova — Issue #2: Handle case of attacker changing IPs
Author: DataSoft
Created: 2012-02-16 19:22:51+00:00
State: open

Currently, Nova relies on IP addresses being a unique identifier for suspects. But it may be possible in some network contexts for an attacker to dynamically switch IPs in order to evade detection.

For example, an attacker may choose to send 10% of the packets from one IP, then the next 10% from another IP, and so on. By themselves, none of the IPs would get flagged as hostile, but together they would. And the attacker could effectively evade detection using this method.

The naive method of "Let's just test every combination of suspect IP addresses together" is obviously far too cumbersome. We have to think of something smarter.

One possibility is to work backwards. Look at the data to see if every (or most) haystack IP has been hit recently (some timeout value) ignoring by who. This then raises suspicion on those nodes who's IP s are in that list. Repeat the process again for some other feature set heuristic(s). Then find overlap between these sets of IPs. Any significant overlap indicates that you've got an attacker switching IPs.

Mitigating Factors: Even if the attacker does evade detection, the Haystack still obfuscates the network. So this doesn't represent a total security failure, only a partial one. But still a case we need to cover.