Einstein 2 detects cyber attack patterns

THE US DEPARTMENT OF HOMELAND INSECURITY will be detecting patterns of cyber attacks from foreign countries, thanks to an intrusion-detection system that is currently being rolled out.

Einstein 2 will be widely deployed in US federal government networks during 2010, but currently only a handful of agencies are running it.

However so far the DHS, the Department of Agriculture, the State Department and the Department of Interior, which have their systems running through it, are alreading noticing some interesting things.

Using Einstein 2 it is has been possible to see how certain attacks target particular departments and particular agencies and others you can see every place it is currently operational.

Nicole Dean, deputy director of the national cybersecurity division of DHS told SFGate that Einstein 2 has been deployed by nine federal agencies that plan to operate their own trusted infrastructure compliant Internet access points. Three carriers - AT&T, Qwest and Sprint - have installed it so far and Verizon is in the middle of doing so.

The DHS is detecting between 100 and 10,000 cyberattacks aimed at each federal agency per week through the Einstein appliances.

Einstein 2 "is allowing us to monitor intrusion sets that weren't previously being monitored and to make that information available through the US-CERT of what's actually occurring and what various types of intrusion sets are active that we may not have been aware of before," Dean said.

The Einstein 2 systems are not using commercially available intrusion-detection signatures. However it has some limitations, apparently. It is a passive network data collection system that doesn't operate in real time.

Traffic comes into a department or agency, a mirrored copy is sent to Einstein 2, and Einstein 2 has the signature sets loaded into it. Some of that traffic will trip a signature that sends an alert to the US-CERT analyst. Once the signature is fired off, US-CERT works with the department to deal with the attack.

Every time there is an attack the department or agency cleans up that machine and removes it from their network so it can be re-imaged and brought back online in a non-infected state.

Already work is underway on Einstein 3, which will give federal agencies near real-time defense against cyberattacks including distributed denial-of-service attacks. µ