Cooperations

The cooperating partners of the R&D project iMonitor (www.imonitor-project.de), DECOIT GmbH, specialized in IT security and data networks, and neusta GmbH, engaged in sustainable product development, generalize AI based on heterogeneous sensor events and develop an analysis and prediction tool for improved monitoring of complex IT infrastructures. Thereby, normalized events from sensor information are collected, automatically learned, interlinked to form rules and used for assistance. The function of accessing background knowledge in the rules, which is either manually developed or automatically generated, adds value to the prediction. Generalizations include questions on the assignability of rule sets, the improvement in efficiency for greater set of outcomes as well as the connection of quantitative with qualitative inference. The SIEM system to be developed can be extended by the use of ontologies flexibly, meaning that different new data sources can be tied to it. One example is Nagios or Nagios-Fork Icinga (interoperable with Nagios), software applied by DECOIT GmbH, which serves to monitor complex IT infrastructure. DECOIT GmbH has not only built up this software failsafe applying it for proactive management of its client’s networks, but also has already extended, for example Icinga, adding intelligent escalation management. Therefore, it is of great interest to further develop such monitoring solutions. Because of the common SIEM topic great synergies between the two projects are expected that may lead to even better results.

The research project VisITMeta (http://trust.f4.hs-hannover.de/projects/visitmeta.html) pursues the objective to design and develop a visualization component in order to display the security of networks using metadata. The project, funded by the German Federal Ministry of Education and Research (BMBF) until March 31st, 2015, is conducted by the research group Trust@HsH, which is part of the Department of Computer Science, Faculty IV of the University of Applied Sciences and Arts Hannover. The expected result of the project is the development of one (or several) software components which display collected metadata of a MAP-Server. A simple display in form of a graph only adds value to the information process up to a certain amount of metadata, compared to conventional text output of components. Therefore, advanced visualization methods need to be analyzed and implemented in VisITMeta. These include approaches for intelligent alignment (Layouting) of metadata regarding their display as well as abstraction of their display in order to partly simplify great amount of metadata. Additionally, comfort functions are sought, such as searching in displayed metadata or filtering certain elements. One of the main functionalities of VisITMeta will be the possibility of chronological examination of metadata that allows temporal movement within the metadata. Hereby, at a certain point in time all preceding events can be followed in the MAP graph in order to analyze the events visually – including human cognition semi-automatically. Being a visualization component, VisITMeta is dependent on the collection of metadata by other IF-MAP collectors that are amongst others created in the SIMU project. The analysis of metadata by means of automatic procedures is not part of VisITMeta. Functions for the use of displayed metadata in order to define the normal condition, for example for correlation by means of anomaly recognition, are not planned. Therefore, an extension or cooperation with the SIMU project at this point would not meet VisITMeta’s project goals. In fact, both projects open up the possibility of interconnecting their results: VisITMeta’s visual processing of metadata and SIMU’s analysis procedure and rule creation function.

Juniper Networks (http://www.juniper.net/us/en), founded in 1996, produces high-end routers which are employed in the core and edge areas of the Internet backbone. The operating system „JunOS” runs on the routers. JunOS was derived from FreeBSD and is based on its current version. The BSD license allows – considering some rules – source code modifications without being obliged to publish them. ASICs are integrated into the equipment and mainly take over router operations which are intense regarding I/O-performance. They are developed by Juniper and manufactured by IBM. Juniper Networks is highly interested in the extension of IF-MAP application and cooperates with the SIMU project. In Juniper’s opinion today’s information security landscape is characterized by an imbalance between attackers, who move rapidly with a suite of automated attack toolkits, and defenders, who employ a disjointed collection of products that do integrate properly. To improve the success rate and speed of defensive tools, flexible automated systems that integrate using open standards must be built. The IF-MAP specification of the Trusted Computing Group (TCG), in which Juniper amongst others takes on a leading role, offers this possibility. Furthermore, many of Juniper’s customers are keenly interested in the topic of Security Automation. They cannot hire enough skilled information security professionals to solve their information security problems with manual techniques alone. Juniper will take active part in the dissemination of project results using its market power.

Enterasys Networks (http://www.extremenetworks.com), the Secure Networks Company, headquartered in Andover, USA, is part of the joint venture Siemens Enterprise Communications Group conducted by „The Gores Group“. The joint venture is provider of hardware, software and services for secure, service-oriented networks which enable open communication based on standards. Enterasys’ innovative security solutions protect every network of every manufacturer and thereby ensure the integrity and performance of IT services for all users. Thousands of leading companies, public authorities and educational institutions in over 70 countries trust in Secure Networks Solutions in order to ensure their business processes and the availability of important information. Enterasys offers granular, policy based control for individual users, applications, equipment, ports and output as well as radical security around the network. Enterasys‘ special architectural approach guarantees long-lasting technology and establishes significant operational and corporate advantages while reducing overall operating costs. The SIMU project is of high interest for Enterasys Secure Networks. The potential of IF-MAP based infrastructures is immense but cannot be utilized these days due to the lack of existing products. The integration of IF-MAP could be applied in several different Enterasys products, especially in NAC-, SIEM- and IDP-solutions. Enterasys’ SIEM-solutions will benefit from the SIEM approach of the SIMU project particularly. The successful progress of the SIMU project may lay further foundation to establish the IF-MAP based security solution of the Trusted Computing Group (TCG) in practice. That is why Enterasys is active member of the TCG and very much interested in project results, especially during the duration of the project. Enterasys will take active part in the dissemination of project results using its market power.

TELCO TECH (https://www.telco-tech.de/en), founded 1993 in Berlin-Teltow, is a German company specialized in high end security-systems. Its product line LiSS (LAN Internet Support Station) covers the entire field of network security. This includes functionalities from firewalls to VPN up to SIEM-characteristics. The LiSS LogApp, for instance, is capable to collect and evaluate log data from Windows, Linux and network devices. The LiSS product family can be implemented in nearly every IT environment. Networks and IT infrastructures are secured by combining different security technologies. TELCO TECHs references are small and medium enterprises as well as large international corporations. TELCO TECH is very much interested in the SIMU project planning to use the knowledge exchange for product improvement. The LogApp was tested extensively by the SIMU project in order to compare its SIEM functionality to the planned one and to incorporate positive aspects into SIMU development. As TELCO TECH shows great interest in German product solutions, cooperation after project completion is sought.