forwarded email on idwg activities

--cWoXeonUoKmBZSoM
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

fyi 
-- 
Mike Erlinger, Professor and Chair Computer Science
www:      http://www.cs.hmc.edu/~mike
email:    [email protected]
smail:    Computer Science Dept., Harvey Mudd College,
          301 E. 12th Street, Claremont, CA, 91711 
          909-621-8912,   FAX: 909-607-8364

--cWoXeonUoKmBZSoM
Content-Type: message/rfc822
Content-Disposition: inline


>From mike  Tue Jan 25 07:32:45 2005
Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by turing.cs.hmc.edu (Postfix) with ESMTP id BC3F853451
	for <[email protected]>; Tue, 25 Jan 2005 07:32:45 -0800 (PST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id j0PFWiev027557
	for <[email protected]>; Tue, 25 Jan 2005 07:32:44 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id j0PFWinB027556;
	Tue, 25 Jan 2005 07:32:44 -0800
Date: Tue, 25 Jan 2005 07:32:44 -0800
From: [email protected]
Message-Id: <[email protected]>
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to [email protected] using -f
To: [email protected]
Subject: BOUNCE [email protected]:    Non-member submission from [Srinivas Guntupalli <[email protected]>]   
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on turing
X-Spam-Status: No, score=0.3 required=7.5 tests=AWL,NO_REAL_NAME 
	autolearn=disabled version=3.0.1
X-Spam-Level: 

>From idwg-l-manager Tue Jan 25 07:32:44 2005
Received: from psmtp.com (exprod7mx24.postini.com [64.18.2.164])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with SMTP id j0PFWgev027542
	for <[email protected]>; Tue, 25 Jan 2005 07:32:42 -0800
Received: from source ([202.141.151.15]) by exprod7mx24.postini.com ([64.18.6.10]) with SMTP;
	Tue, 25 Jan 2005 05:32:41 HST
Received: from mta.ncst.ernet.in (mta.ncst.ernet.in [202.141.151.15])
	by mta.ncst.ernet.in (8.11.0/8.11.0) with ESMTP id j0Q2MN013167
	for <[email protected]>; Tue, 25 Jan 2005 21:22:23 -0500
Received: from localhost.ncst.ernet.in ([127.0.0.1])
	by mta.ncst.ernet.in (MailMonitor for SMTP v1.2.2 ) ;
	Tue, 25 Jan 2005 21:22:17 -0500 (GMT+5)
Received: from yuga.ncst.ernet.in (yuga.ncst.ernet.in [202.141.152.2])
	by mta.ncst.ernet.in (8.11.0/8.11.0) with ESMTP id j0Q2MA713108;
	Tue, 25 Jan 2005 21:22:10 -0500
Received: from localhost (srinivas@localhost)
	by yuga.ncst.ernet.in (8.11.7p1+Sun/8.11.6) with ESMTP id j0PFR7x07956;
	Tue, 25 Jan 2005 20:57:08 +0530 (IST)
Date: Tue, 25 Jan 2005 20:57:07 +0530 (IST)
From: Srinivas Guntupalli <[email protected]>
To: IDWG Mailing List <[email protected]>
Subject: Proposed suggestions to IDMEF draft version-13
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-pstn-levels:     (S:99.90000/99.90000 R:95.9108 P:95.9108 M:97.0232 C:98.7678 )
X-pstn-settings: 3 (1.0000:1.0000) s gt3 gt2 gt1 r p m c 
X-pstn-addresses: from <[email protected]> [db-null] 
X-Spam-Status: No, hits=0.0 required=8.0 tests=none autolearn=no version=2.63
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on mail2.ac.hmc.edu


We are a team working in the field of Network and System Security at the
Centre for Development of Advance Computing(CDAC), Bangalore, India. We
have been following the IDMEF draft for the past two years and have found
it to be quite comprehensive and well thought out. This has prompted us to
use IDMEF as a message format for communication between the IDS entities
of our IDS. For this we are very grateful to the Intrusion Detection
Working Group.

Working on intrusion detection systems, we believe the latest version of
IDMEF(13) can be enhanced to facilitate even more comprehensive
communication between the IDS entities. Considering the present IDS
scenarios and their applications, one finds multiple IDS entities deployed
all over the network and across networks. In such an environment, the
entities would have much more to share than Alerts and Heartbeats.

During our work in the field of intrusion detection, we realised that
sharing information, about the entities themselves can make the system
more robust and survivable.

As IDMEF is supposed to fulfill all the requirements of format of
messages that could be exchanged among ID entities, we feel, there should
be some way to deal with "control information" that an ID entity would
like to send to other entities. Here, we would like to complement the set
of messages supported by IDMEF by a new group, which we call, "Control
Messages". The proposed group would consist of 5 sets of messages,
classified based on the kind of control message and the action expected
from the receivers viz., instructional, operational, announcements,
success and exception messages.

Since the information shared is neither an Alert category, nor a
HeartBeat, we propose to introduce a new heir of the IDMEF-Message.
"Control-Message" seems to be an appropriate name. Moreover, the
information cannot be sent using the existing IDMEF structure (either
Alert or Heartbeat). The Control-Message further can have hierarchy
similar to the one with Alert.

Certain advantages by having such control are:
   a. Synchronization is achieved between the IDS entities
   b. Entities can be better informed and be up-to-date about 
      co-operating ids-entities
   c. Possibility of task delegation
   d. Announcement of finer performance details of entities.
   e. Operational status of entities

The position of the proposed "Control-Message" against the current
messages can be visualised as follows,

                   +---------------+
                   | IDMEF-Message |
                   +---------------+
                          /_\
                           |
       +--------------+------------------+
       |              |                  |
   +-------+    +-----------+    +-----------------+
   | Alert |    | Heartbeat |    | Control-Message |
   +-------+    +-----------+    +-----------------+

We look forward for your feedback on the proposal.

Thanks & regards,
srinivas.

--------------------------------------------------------------------------------------
Srinivas Guntupalli
Centre for Development of Advanced Computing,
Navi Mumbai 400614, India.
Phone: +91-22-27560013 Telefax: +91-22-27560004
Website: http://www.ncst.ernet.in
email:[email protected]


--cWoXeonUoKmBZSoM--