Slashdot Mirror
Military Spends $4.4M To Supersize Net Monitoring
coondoggie writes "Bigger, better, faster, more are the driving themes behind the advanced network monitoring technology BBN Technologies is building for the military.
The high-tech firm got a $4.4 million contract today from the Defense Advanced Research Projects Agency (DARPA) to develop novel, scalable attack detection algorithms; a flexible and expandable architecture for implementing and deploying the algorithms; and an execution environment for traffic inspection and algorithm execution. The network monitoring system is being developed under DARPA's Scalable Network Monitoring program which seeks to bolt down network security in the face of cyber attacks that have grown more subtle and sophisticated."
That sounds like a lot, but it did come with fries.
If brevity is the soul of wit, then how does one explain Twitter?
$4.4 million for a system to detect what one person getting paid nothing will circumvent within days/hours/minutes of implementation.
to cater the meetings to discuss the project.
Don't mess with The Phone Company. Piss them off and you'll be using two tin cans and a piece of string.
It doesn't actually sound like all that much to me. Frankly, I'm surprised that they're not spending 10x as much already. Of course, maybe they are...
Give me Classic Slashdot or give me death!
The most practical use I can see for this is capturing pr0n for military use. (you figure out "use")
$.4.4 million? So is that like $440k? $400,000.40?
Considering the requirements laid out in TFA, I am exceedingly dubious that they will come up with anything for this price tag. Also note this same company got $13 Million for a program to quickly translate documents for the military. I'm guessing that one will also go nowhere. Security and Translation are two notoriously difficult things to get right.
So much for ordering off the dollar menu.
It doesn't actually sound like all that much...
Whoooosh!
It doesn't actually sou...
Whoooosh!
It doe...
Whoooosh!
Whoooosh! That was a preemptive whooosh.
In Soviet America, net surfs YOU!
to develop novel, scalable attack detection algorithms
'novel' just doesn't carry the same meaning anymore. USPTO is a prime example.
Fact: Everything I say is fiction.
The business model for this type of research is to not solve the problem. If you solve the problem, how are you going to get paid next year? You have to solve enough of the problem to show that you can make progress on it, but leave enough on the table for the next contract.
Sounds a lot like they are trying to build SNORT. Maybe instead of developing something new they should take a look at what's already out there. While your average 'security joe' isn't going to understand how the management of snort is VERY scalable, it is pretty easy once you are capable of scripting =) Simply buy the commercial version of SNORT from SourceFire...
As for gripes and complaints on snort being single threaded and not able to handle large amounts of traffic. Garbage. I've managed clusters of snort collectors taking in over a gbit per snort process, multi-gbit per server. Break up your rulesets into smaller ones and only load once in a process that is related. Run multiple instances of snort on a single interface...blam, you've got an analysis engine that is scalable and easily controllable through scripting that you can customize rules for and its efficient. Look for whatever you want with a snort box.
This article asks for nothing specific other than 'algorithms' to detect things. They didn't say anything like network (AI) behavioral based IDS. Nothing new here, move along.
There comes a time when people have to either accept responsibility for themselves or they have to bow before the government they demand take care of them and remove responsibility. This is one of those times.
People demand that the government protect their computers, so the people who have them and store attractive data do not have to. People demand that the government filter their TV content so parents dont have to. People blame everyone but themselves when something bad happens, often with litigation as the consequence of trying to force blame elsewhere.
Those that do cybercrimes are not the real problem, those that leave their networks open to multi-year old attacks are the problem. The same can be said of TV, video games, music, etc - they arent the problem, people who dont want that stuff in their homes have an easy alternative - change the channel, dont buy the game/cd/etc and stop begging the government to control things more.
If the government abuses the power that the people demanded it assume, whose fault is that? Hint its not the governments, its their very nature to always expand their power and abuse what power they have, its the people that demanded the government do more, and themselves did less.
If there's one thing the government hasn't learned yet it is paying money to some company about something they don't understand is generally a bad idea.
It's all fun and games until some kid from Finland renders your new-bought toy obsolete.
If you quote this signature there'll be 72 copies of Windows ME waiting for you in Heaven.
Well DARPA invented the internet (not to mention a large number of other achievements that are significantly more sophisticated). What are your qualifications, Mr. Smartguy, for forming an opinion on what can be done?
Are agnostics skeptical of unicorns too?
The article doesn't say, but it seems logical that they would want the US military network to be able to handle both an attack like the one launched earlier this year against Georgia's internet infrastructure (likely by Russia) and the almost-certainly Russian-based one during actual armed conflict this week.
DoD has a budget of about $439.3 billion and DARPA gets $3.2 billion of that (according to Wikipedia). $4.4 million doesn't sound like that much out of that kind of budget, but I'd be interested in what they actually come up with. Doubt the general public will see anything created by this project for at least 10 years, though.
Wrong, wrong, wrong... Net Monitoring is one of those disciplines that has no end. Hackers, viruses, and Trojans are ever changing. New threats, sites, and IPs appear every day. It is much like chess: your opponent makes a move, you counter it, and he makes yet another move. No one's network is without its threats, no matter the manufacturer or operating system.
What do I base my statements on? I do network security full-time for about 50,000 users.
Is this guys a bot? I've seen this exact comment in at least one other thread.
What's the value of information that you don't know?
"BBN earlier this year got $13 million in additional funding from DARPA to develop a system that quickly converts documents in foreign languages into English so that military personnel can react more rapidly to threats."
they never heard of babelfish or google translator i take it
As posted by CmdrTaco:
$.4.4 million
That's not off topic. The post as it reads right now is "$.4.4 million". Sure, we can assume it is 4.4 million because it seems like an nonsensical number otherwise, but this is very unclear and should be corrected.
Fact: Everything I say is fiction.
Ok people, is it time yet? We need to encrypt ALL traffic.
---- Booth was a patriot ----
So does that mean they bought Real Cisco routers and not the nock-offs from china with the HUGE security holes?
That is lots of fundamental research we are talking about. I am no expert in network monitoring, but 4.4M to solve the following problems seems like peanuts:
Probability of detection of malicious traffic greater than 99% per attack launched
While some types of traffic are obviously not ham (say, spoofed IPs or syn scans), assigning intent to raw data flows requires nothing less than strong AI. Think of spam - anybody can fool a spam filter, no matter what filter, given enough time and motivation. You can also fool the human reading the mail, for that matter...
A false alarm rate while monitoring traffic of not more than one false alarm per day.
This makes a whitelist approach a lot harder. My guess is that any decent system will flag many, many things, and prioritize some over others. That way it is up to the network operator to dig deeper or not into each individual incident, using the program's classification as a starting point. I have no idea why email programs don't allow you to rank messages on "perceived spamminess" - it would make digging for false positives and negatives a lot easier...
Support capabilities at conventional gateway line speeds of 1Gbps in Phase I of the contract, while Phase II will demonstrate the scalability of this capability at gateway line speeds of 100Gbps.
This part, together with the "very high scalability" requirement, is the icing on the cake. It is impossible to detect complex threats in real-time, so the best bet would be to layer defenses. Very fast reflexes for certain behavior (say, DDOS), longer mulling times for patterns that are more deeply hidden (say, a covert channel somewhere).
In any case, 4.4M is peanuts to meet these goals at full strength. The most probable outcome is some fundamental research, partial successes, and another grant in a few years (possibly to a different team) to try to get further along the track.
The cost of the test hardware alone would exceed 4.4 million, if this is really to be tested on 10+ Gbps gateways. You're talking long-haul DWDM or perhaps "experimental" hardware if you want a valid test. It ain't cheap.
Ever work on a big project? One that was over due by a significant amount? Yeah, easily $4M.
That amount is like the military paying someone to think about it and give them a paper on it. I've been on civilian-side government projects that were well beyond $4M. Sounds like someone got a "sure, toss some cash at it and see what happens" approval, but not an official "this is a priority, make it so" approval.
Now, $40M is where we start to see some serious thinking about the issue. Yeah, it's an arbitrary amount, but warfare grade network inspection and defense? $40M would be a drop in the bucket for R&D for such a system. $4M is a joke.
"Doubt your doubts and believe your beliefs." -- Switchfoot, Ode to Chin
In minesweeper, if you find a square with an 8 in it, any square within the immediate vicinity is gauranteed to be a Bomb. The President of Chrysler, Jim Press, explains his company's shrinkage.
That's such a tiny budget that it in effect suggests that no real work is being done at all.
These days building a new high school can eat up more than 16 million dollars. Net security and monitoring migh call for a multi billion dollar project.
I know law firms who have a bigger annual budget than that.
Can we name it Skynet?
Not only that, guess who had the ARPANET contract? BBN. I dealt with them for years, and they are a very capable organization. Chances are they can deliver what they say.
I prefer rogues to imbeciles because they sometimes take a rest.
Actually it sounds like far too little.
The root of the problem is that the USA has been pissing everyone else off for the better part of a century. Were it not for that key fact, the military probably wouldn't be afraid of everyone everywhere, including their own citizens.
-Billco, Fnarg.com
I think the military really understands how big a threat cyber attacks are/will be. Thank Jebus.
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011