Subject: [domainrep] Informational RFC on reputation intelligence?

From: Tyson Macaulay <[email-masked]>
Date: Sun, 15 Apr 2012 09:41:08 -0400

Everyone,

I attended the domain rep session in Paris and went to the mic to mention
an IPv6 Destination Option draft which described a delivery system for
reputation information.  (See
https://datatracker.ietf.org/doc/draft-macaulay-6man-packet-stain/)

Knowledgable 6man veterans have advised me that an informational RFC
related to the problem-statement should be developed, circulated and
accepted before driving forward with the v6-Destinatin Option draft.

The problem statement under consideration would consist of:

1) a description of internet reputation intelligence and how it might be
derived (spam logs, botnet C&C traffic, DDOS attacks, other indicators of
intent or compromise)
2) the proactive capabilities and benefits of  reputation intelligence
3) the challenges of legacy, signature and heuristic-based threat
management systems
4) review of different reputation-delivery models

My question to this group: has this already been done in full or in part
elsewhere for IETF?

I reviewed draft-dskoll-reputation-reporting-04 and the other related
drafts but did not notice a detailed discussion of this nature.  (Please
forgive me if I have missed something that should be obvious).

Thanks,

Tyson

-- 
Tyson Macaulay, BA CISSP CISA
VP  Technology
2Keys Security Solutions
Phone: +1 613 292 9132
email: [email-masked]

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 16 Apr 2012 03:28:13 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Tyson Macaulay
> Sent: Sunday, April 15, 2012 6:41 AM
> To: [email-masked]
> Subject: [domainrep] Informational RFC on reputation intelligence?
> 
> My question to this group: has this already been done in full or in
> part elsewhere for IETF?

To my knowledge, no.

> drafts but did not notice a detailed discussion of this nature.
> (Please forgive me if I have missed something that should be obvious).

We're aware of that work, but we're currently not chartered to include it.  I believe at one point we had considered it for development after the current charter completes.

The current charter is only about how to ask a reputation service about something and get a reply.  We're so far specifically avoiding questions related to how one develops a reputation since that's often both proprietary and context-specific.

-MSK

---

From: "David F. Skoll" <[email-masked]>
Date: Mon, 16 Apr 2012 10:10:12 -0400

On Mon, 16 Apr 2012 03:28:13 +0000
"Murray S. Kucherawy" <[email-masked]> wrote:

> > [mailto:[email-masked]] On Behalf Of Tyson Macaulay

> > I reviewed draft-dskoll-reputation-reporting-04 and the other
> > related drafts but did not notice a detailed discussion of this
> > nature. (Please forgive me if I have missed something that should
> > be obvious).

> We're aware of that work, but we're currently not chartered to
> include it.  I believe at one point we had considered it for
> development after the current charter completes.

The terminology is unfortunate.  My draft uses the word "reporting" to
mean a mechanism by which sensors report events to a reputation system
that generates reputation profiles based on those events.

The domainrep group uses "reporting" to mean a way for a reputation system
to report reputation information to clients.

The packet-staining idea is interesting, but including a URL of malicious
content in an option at the network level seems wrong to me.  I think it's
trying to solve the problem at the wrong layer.

Regards,

David.

---

From: Tyson Macaulay <[email-masked]>
Date: Mon, 16 Apr 2012 18:06:23 -0400

-----Original Message-----

From: "David F. Skoll" <[email-masked]>
Date: Mon, 16 Apr 2012 10:10:12 -0400
To: "[email-masked]" <[email-masked]>
Subject: Re: [domainrep] Informational RFC on reputation intelligence?

>trying to solve the problem at the wrong layer.

Your instincts are probably rights.  The URL notion was a requirement that
bubbled up during initial requirements analysis and was put into the 00
draft for "reaction".

Thanks for your comments. Pending further responses, I will take a run at
an informational draft (in 6man) about reputation information and the its
benefits as an adjunct to legacy signature-based systems.

Tyson