In this paper a concept and an architecture of the Federated Networks Protection System (FNPS) is proposed. The system components are described and, particularly, the Decision Module (FNPS-DM) is discussed. The major contributions of the paper are: concept of federated networks security, the proposition of the network events correlation approach and semantic notations aimed at detecting complex cyber attacks and 0-day exploits. Moreover P2P based communication between federated networks is proposed.

Network events correlation for federated networks protection system

In this paper we present semantic approach to network event correlation for large-scale federated intrusion detection system. The major contributions of this paper are: network event correlation mechanism and semantic reasoning based on the ontology. Our propositions and deployments are used in Federated Networks Protection System as a part of the Decision Module.

Network Event Correlation and Semantic Reasoning for Federated Networks Protection System

There are numerous challenges one can face while creating joint network management in tactical networks. Although many of these challenges are political, there are significant technical challenges that are currently being addressed by the research community. This article presents some of the challenges faced by the NM architecture from the tactical edge and across the global information grid, where IPbased networks and radios must work together seamlessly in joint missions in the presence of encryption tunnels. It shows some cases where unconventional NM techniques must be considered in order to meet the objectives of joint missions. These techniques should be considered when different networks from the same force (e.g., the U.S. Army), joint U.S. military services' networks, and coalition forces' networks interface together. The article is divided into three main sections. The first presents some of the urgent challenges facing NM interoperability across the GIG, while the second covers an architectural approach that relies on gateway nodes and abstraction techniques. The third section presents a conflict resolution case showing how different tactical network managers need to interface to each other with techniques that are not considered in commercial networks.

Network management challenges for joint forces interoperability

In this article, a comprehensive approach to information sharing framework aimed at increasing network security and survivability is presented. Currently, in order to defend complex cyber-attacks and sophisticated cybercrime, comprehensive means of ensuring network security and survivability are highly demanded. Comprehensive is understood as at least technical, human, organizational, and regulatory dimensions, whereas technical means that both on-line and off-line aspects should be carefully taken into account. The focus of this article is on the technical dimension and, in particular, on information exchange mechanisms for on-line and off-line dimension. Firstly, the on-line information exchange mechanism dedicated for interconnected federated networks is described. Then, a proposition of the off-line network information sharing approach regarding results of the risk assessment, cybersecurity audits, threat ranking, etc., is discussed. Developments and results of information sharing mechanisms in both on-line and off-line network security dimensions are also described.

Comprehensive approach to information sharing for increased network security and survivability

The research of mobile ad hoc networks has attracted a lot of attentions recently. In particular, extensive research efforts have been devoted to the design of clustering strategies to divide all nodes into a clustering architecture such that the transmission overhead for the update of routing tables after topological changes can be reduced. The performance of a clustering architecture has been demonstrated to be closely related to the number of its clusters. In this paper, we will propose an efficient clustering algorithm to minimize the number of clusters and the variation of cluster sizes. Computer simulations show that both the number of clusters and the variation of cluster sizes generated by our clustering algorithm are less than those generated by other existing clustering algorithms that also aim to minimize the number of clusters.

Minimizing both the number of clusters and the variation of cluster sizes for mobile Ad hoc networks

Global information grid (GIG) is becoming a reality with emerging state-of-the-art communication system infrastructure. In this paper, we describe issues facing both global and tactical network managers. We also propose a model for developing a global network management architecture. The main elements of our proposed model include network management (NM) concept of operations (CONOPS), requirement space, technical reference architecture, reference design, and implementation/development framework. We further describe the key areas that an integrated NM CONOPS must address.

J. Crowley

Papers

Hierarchical and federated network management for tactical environments