Thoughts on the Internet Security Unit

Over the past few weeks, we have researched Internet security--the more recent threats, as well as countermeasures against the attacks made. The problems we looked at ranged from Botnets to DDoS to DNS attacks to Spam attacks. The solutions included anomaly detection using a variety of approaches, reputation systems, blacklisting and cheating detection.

One of the thoughts I've had is that network security is not so much a problem of bad system design as much as it is a perpetual game between the "bad guy" and security research. Either party is rewarded by staying one step ahead of the other. The "bad guy" always has plenty of incentive to come up with a new security threat, and that gives security a good reason to come up with a countermeasure against the threat. In a sense, the good and bad guys are creating a competitive market for each other.

Also, I was previously unfamiliar with how Botnets worked. It was pretty impressive (albeit quite insidious) that a system can be designed to take command of tens of thousands of computers and use them to perform an arbitrary task. Robust distributed systems are hard to design. (Well, who knows if Botnets are designed robustly?)

We discussed several reputation systems. Collusion seems to be a persistent problem in reputation system design. It is a hard problem because colluding peers can game the system by taking advantage of good peers and rating other colluding peers well, thus damaging the accuracy of the rating system. I have read papers on reputation systems, but none of them has applied the study of evolutionary dynamics and evolutionary stable strategies to them. I read an excellent book this semester that sheds light on design of a robust social structure. It discusses the conditions that allow or prohibit invasion into a society of agents. Translating collusion into the language of the book, if a reputation system can be designed where peers have an evolutionarily stable strategy, the peers will be able to resist invasion by a colluding group of attackers.