Hasta la vista, attacks

Research continues

Therminator technology is the Defense Department's radical response to virulent network security threats.


Malicious code has been growing exponentially in sophistication, Therminator developers said in the current CHIPS Magazine, the Navy's IT journal, at www.chips.navy.mil.
'Therminator is well-suited as a transformational enabler for the network-centric vision of FORCEnet,' the Navy's architecture for integrating IT systems, the authors said.


The first commercial release, developed at government and academic laboratories, came last year from Lancope Inc. of Atlanta.


Research in government applications for Therminator continues at the Naval Postgraduate School, the University of South Carolina and the Georgia Institute of Technology. Possible Therminator extensions include implementation in hardware to operate at gigabit speeds.


Current Therminator test sites include the Pacific Command Network Operations Center at Fort Shafter, Hawaii; Pacific Command Headquarters at Camp H.M. Smith, Hawaii; and the Army Signal Command at Fort Huachuca, Ariz. More implementations are planned.

Therminator program managers John McEachen, left, and David Ford say StealthWatch+Therminator visualization makes it easier to understand network traffic.

Orville Myers

'We've been doing intrusion detection basically the same way for the last 20 years.'

'John McEachen

Orville Myers

Government-bred Therminator melds physics and network monitoring

A traffic analysis tool conceived by the National Security Agency and born at the Naval Postgraduate School has come of age in a commercial application.

Lancope Inc. of Alpharetta, Ga., has incorporated the government's Therminator tool into its flagship StealthWatch intrusion detection product.

Therminator applies thermodynamics principles to network traffic flow to identify anomalous behavior that might indicate an attack.

The Naval Postgraduate School in Monterey, Calif., licensed the technology to Lancope.

'They wanted to see it commercialized,' Lancope chairman John A. Copeland said. 'We're just going into evaluations' of the StealthWatch+Therminator product with government and commercial testers. 'We have had it since last spring on a number of government networks.'

Therminator applies the thermodynamic rules governing energy and equilibrium to the state of network traffic, as a physicist might analyze the state of a volume of gas.

'We're looking at communications on a network, and communications involves a source and a sink' much like energy in a gas, said John McEachen, director of the school's Reconfigurable Intrusion Detection and Deception Laboratory. 'Once you map it into that paradigm, it ports pretty directly.'
[IMGCAP(2)]
The new technique is necessary to keep up with more sophisticated attacks against networks, McEachen said. 'We've been doing intrusion detection basically the same way for the last 20 years,' looking for known signatures or anomalous traffic patterns.

Modern attacks, however, can change their spots and blend into acceptable traffic patterns, which makes them difficult to identify.

'We just can't use the same approaches today,' McEachen said.

Former NSA mathematician Dave Ford conceived the new approach and has since been assigned to the Naval Postgraduate School.

'I saw Dave's idea and thought it was ingenious,' McEachen said. 'I wanted to get some of my students involved.'

Ford had been working on the idea since 1998 and met McEachen in September 2000.

By that December three students'Navy lieutenants Stephen Donald and Daniel Ettlich and Marine Capt. Robert MacMillan'were developing the software at the school's Cebrowski Institute for Information Innovation and Superiority.

'In a matter of three months, they took Dave's idea from theory to application,' McEachen said.

In thermodynamics, the relationship of entropy'or unavailable energy'to temperature defines the state of a closed system. When that system is a network, entropy can be seen as an equilibrium of traffic between classes of senders and receivers. The volume of traffic replaces temperature. Using those principles, Therminator analyzes changes in the network's state.

'In a way, we're doing thermodynamics backward,' McEachen said, by absorbing large amounts of detail into a macro-level view. 'We're doing intelligent data reduction.'

It took another year of refinement before the school approached Lancope in early 2002 about commercializing Therminator.

'We spent the next year recoding and integrating it into StealthWatch,' Copeland said.

Therminator adds visualization to the traditional StealthWatch elements, which log network activity and do flow and packet analysis to show administrators what exactly is happening when suspicious changes in state occur.

StealthWatch+Therminator costs $35,000 for copper Ethernets with speeds up to 100 Mbps, and $50,000 for fiber Ethernets.

Hunt goes on

Work on Therminator continues at the Cebrowski Institute.

'It's not necessarily restricted to IP networks,' McEachen said. Any communication medium has underlying exchange mechanisms that could be analyzed the same way.

'One of the things we're looking at is networks of intelligence resources,' he said. 'What would the effect be on the remaining resources if one was removed?'

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above