Romanian Educational and Research Network

IT infrastructure exposed to Internet for a period of time, will inevitably expose it to attacks with viruses (worms or trojans). Our current available methods are known not to be full-proof for their prevention and in the worst case the detection of computer system with unauthorized (remote) access. This paper proposes and extended method, applying time series techniques while evaluating the network transfer data. The proposed method tries to improve the detection of abnormal network activity, thus providing a better trigger for other more costly solutions. The downside of this approach is that the system must be informed about changes in networks services and content and still needs a lot of data to be collected in order to provide accurate results. Correlated with netflow® LAN data, the method can be used to identify network stations that are infected with viruses not detected by the installed antivirus solution or stations with compromised security systems.

Grid computing is evolving fast, with specific needs for computing power, storage capacity and available bandwidth. Network security is a big concern for grid networks because attacks can endanger the availability of grid usual services. High amounts of data transferred between sites can make difficult the traffic analysis needed to identify possible cyber-attacks. This paper presents some aspects about network specific security improvements done in RO-LCG and how existing open-source tools can be used to gather, analyze and discover relevant information about what is happening within the network.