Tsinghua Science and Technology

2013, v.18(01) 40-50

[打印本页] [关闭]
本期目录(Current Issue) | 过刊浏览(Past Issue) | 高级检索(Advanced Search)

Cloud Computing-Based Forensic Analysis for Collaborative Network Security Management System
Cloud Computing-Based Forensic Analysis for Collaborative Network Security Management System

Zhen Chen;Fuye Han;Junwei Cao;Xin Jiang;Shuo Chen;


Internet security problems remain a major challenge with many security concerns such as Internet worms, spam, and phishing attacks. Botnets, well-organized distributed network attacks, consist of a large number of bots that generate huge volumes of spam or launch Distributed Denial of Service (DDoS) attacks on victim hosts. New emerging botnet attacks degrade the status of Internet security further. To address these problems, a practical collaborative network security management system is proposed with an effective collaborative Unified Threat Management (UTM) and traffic probers. A distributed security overlay network with a centralized security center leverages a peer-to-peer communication protocol used in the UTMs collaborative module and connects them virtually to exchange network events and security rules. Security functions for the UTM are retrofitted to share security rules. In this paper, we propose a design and implementation of a cloud-based security center for network security forensic analysis. We propose using cloud storage to keep collected traffic data and then processing it with cloud computing platforms to find the malicious attacks. As a practical example, phishing attack forensic analysis is presented and the required computing and storage resources are evaluated based on real trace data. The cloud-based security center can instruct each collaborative UTM and prober to collect events and raw traffic, send them back for deep analysis, and generate new security rules. These new security rules are enforced by collaborative UTM and the feedback events of such rules are returned to the security center. By this type of close-loop control, the collaborative network security management system can identify and address new distributed attacks more quickly and effectively.




基金项目(Foundation): supported by the National Key Basic Research and Development (973) Program of China(Nos.2011CB302805,2011CB302505,2012CB315801,and2013CB228206);; the National Natural Science Foundation of China(No.61233016);; supported by Intel Research Councils UPO program with the title of Security Vulnerability Analysis Based on Cloud Platform

作者(Authors): Zhen Chen;Fuye Han;Junwei Cao;Xin Jiang;Shuo Chen;