Nasir Memon, Professor of Computer Science and Engineering at the Polytechnic Institute of NYU, has developed a network-based infection detection system to identify compromised host computers on large networks.

"Instead of focusing on blocking the infection from getting in, we assume there is an infection and we focus on detecting the infection," says Memon. "Intrusion prevention is not enough. You have to be watching inside your network very carefully and looking for infections."

Memon described his system—dubbed INFER--at the Cyber Infrastructure Protection Conference held at City College of New York on Thursday.

For more on network research projects, follow our Alpha Doggs blog

INFER is designed to detect the kind of targeted, stealthy attacks that organized crime and foreign countries tend to launch against corporate and government networks. These slow-moving attacks are difficult for network managers to detect with firewalls, anti-virus, intrusion prevention or intrusion detection systems that focus on known malware trying to get inside networks.

INFER, on the other hand, focuses on the malware already inside networks. INFER uses sensors deployed next to routers and switches to passively monitor network traffic and summarize it. INFER has a data mining engine that analyzes the summaries and looks for infected machines.

INFER's console provides network managers with a list of the top 10 host computers that appear to be infected. It also has a forensics component that allows a network manager to track historical traffic patterns on specific hosts.INFER doesn't look for known malware or attacks, nor does it seek the signatures or behavior patterns associated with them. Instead, INFER looks for hosts displaying symptoms that an infected machine would exhibit, regardless of the infection. INFER checks PCs for a dozen symptoms such as slowdowns, frequent reboots, DNS reconnections and hosts acting like relays or proxies.

"The moment the attacker starts doing things with a compromised machine, it will start showing footprints on the network. That's what we want to focus on," Memon said. "It's like a surveillance camera recording everything that's going on in the network."

INFER creates a synopsis of network traffic, rather than storing all of the network traffic for analysis. By using a synopsis of network traffic, INFER makes it easier for users to store up to three months worth of data and to transfer the data over a network for central review.