Internship at IBM

1
Internship at IBM

• Dai Nojiri
• Computer security laboratory
• University of california, Davis

2
Agenda

• About the internship
• Overview
• How did I get the job?
• Other things you might want to know
• About the research
• Problem
• Approach
• Future work

3
Overview

• Where?
• IBM T. J. Watson research center, NY
• When?
• From 6/16 to 9/5
• What is my job?
• Research on intrusion response systems

4
How did I get the job?

• 1/28 Prof. Felix Wu forwarded email from Dr.
  Cheng (T. J. Watson) to Seclab.
• 2/11 Sent email to Dr. Cheng with resume.
• 2/14 Received email from Dr. Pankaj (T. J.
  Watson), asking me to take phone interview.
• 2/19 Phone interview
• 2/19 Dr. Cheng asked me for recommendation
  letter.
• 2/20 Prof. Karl sent recommendation letter.
• 3/11 Received offer

5
Other things you might want to know

• 8 people in my group. (2 interns)
• 2 group meetings/week.
• One laptop, one desktop
• Flexible work time
• Some events for students
• NY city is great!!
• Please ask me privately for more information.

6
About the research
7
Problem

• Protect the network from compromised hosts while
  minimizing business impact.
• Contain a worm/intruder
• Most approaches ignored/paid little attention to
  business impact

x--------
8
Watson memo515 PM 08/12/03

• ALL Windows systems that show behaviors relating
  to this virus (W32.Blaster.Worm) will be
  DISCONNECTED from the Watson network immediately,
  by disabling the specific office network
  connectivity port. Any other systems connected
  to this port will also lose connectivity.

-x-------
9
Internet
Router1
Firewall1
DMZ
Mail

Switch1
Web1

PC

DNS

Firewall2
HTTP

PPP
Router2
Switch3
Web2


Hub
Switch2

PC
UNIX
PC
PC
WS
WS



Windows File Sharing


--x------
10
Containing a worm
h
Find infected host(s).
secondary effect
5
6
g
f
c
Draw a service link graph
d
7
2
4
(low)
e
Determine a containment
a
3
Infected host
b
1
x (high)
Terminate links
V(1) asset value of node 1 V(a) asset value of
link a
V(f)
V(1)V(2)V(3)
V(a)V(b)
V(c)V(d)V(e)
Business impact
-----x---
11
Three classes of reachability graph
total cost
a
b
x
y
a
b
x
a
b
------x--
12
Containment search algorithms for each class
-------x-
13
Future work

• Complete algorithmic engineering
• Finish implementation of containment strategy
• Simulate to evaluate effectiveness

--------x