Subject: [Dots] Dots and Information model for threats

From: Daniel Migault <[email-masked]>
Date: Tue, 24 Mar 2015 14:59:29 -0400

Hi,

Looking at the coming BOF on DDoS, I would be interested to have opinions
on whether using an information model to describe the threats would be
useful to derive the appropriated events to track/measure. Appropriated
alarms could be reported in order to take the appropriated mitigating
actions.

I believe questions could be:
    - 1) Your opinion on feasibility and level of complexity?
    - 2) Your opinion on advantages in term of management, deployment...?

    - 3) Your opinion on how it could ease addressing future threats?

Feel free to make any additional comments!

-- 
Daniel Migault
Ericsson

---

From: kaname nishizuka <[email-masked]>
Date: Wed, 25 Mar 2015 05:09:00 +0900

I'd like to add a comment.
Regarding those points, I don't think it's good way to include the name 
of tools in the predefined list of the threat like slowloris, R.U.D.Y 
etc...,
because devices(or network) under an attack have no way to know the 
exact name of the tool which is used.

thanks,
kaname nishizuka/NTT Comminications.

On 2015/03/25 3:59, Daniel Migault wrote:
> Hi,
>
> Looking at the coming BOF on DDoS, I would be interested to have 
> opinions on whether using an information model to describe the threats 
> would be useful to derive the appropriated events to track/measure. 
> Appropriated alarms could be reported in order to take the 
> appropriated mitigating actions.
>
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Wed, 25 Mar 2015 12:01:20 +0000

Actually, for draft-teague-open-threat-signaling-00, it’s not the devices under an attack, but the ddos mitigation devices to exchange the event information.
So, the attack type information can be exchanged between different devices. The point is how to define the attack type.

Another interesting point is how the solution support the new attack awareness and negotiation, this feature is related with the flexibility and extensibility.

发件人: Dots [mailto:[email-masked]] 代表 kaname nishizuka
发送时间: 2015年3月24日 15:09
收件人: Daniel Migault; [email-masked]
主题: Re: [Dots] Dots and Information model for threats

I'd like to add a comment.
Regarding those points, I don't think it's good way to include the name of tools in the predefined list of the threat like slowloris, R.U.D.Y etc...,
because devices(or network) under an attack have no way to know the exact name of the tool which is used.

thanks,

Looking at the coming BOF on DDoS, I would be interested to have opinions on whether using an information model to describe the threats would be useful to derive the appropriated events to track/measure. Appropriated alarms could be reported in order to take the appropriated mitigating actions.

[图像已被发件人删除。]

--
Daniel Migault
Ericsson

Dots mailing list

[email-masked]<mailto:[email-masked]>