Integrating Intrusion Detection and Network Management - Netmode

,QWHJUDWLQJ,QWUXVLRQ'HWHFWLRQDQG1HWZRUN0DQDJHPHQW 3DQDJLRWLV$VWLWKDV*LRUJRV.RXWHSDV%DVLO0DJODULV

1HWZRUN0DQDJHPHQWDQG2SWLPDO'HVLJQ1(702'( /DE 'HSDUWPHQWRI(OHFWULFDODQG&RPSXWHU(QJLQHHULQJ 1DWLRQDO7HFKQLFDO8QLYHUVLW\RI$WKHQV ,URRQ3ROLWHFKQLRX=RJUDSKRX$WKHQV*UHHFH WHO  ID[  HPDLO^SDVWJNRXWHSPDJODULV`#QHWPRGHQWXDJU $%675$&7 7KH SUROLIHUDWLRQ RI DSSOLFDWLRQV VXFK DV (OHFWURQLF &RPPHUFH DQG WKH LQFUHDVLQJO\ LPSRUWDQW UROH WKDW FRPSXWHU QHWZRUNV VXFK DV WKH ,QWHUQHW SOD\ LQ WRGD\ VZRUOGKDYHSXVKHGWKHVHDUFKIRUPRUHVHFXUH V\VWHPVWRWKHIRUHIURQWRIFRPSXWHUVFLHQFHUHVHDUFK 2QH RI WKH PRVW SURPLVLQJ UHFHQW DGYDQFHV LQ WKH DUHD LV WKH LQFUHDVLQJ GHSOR\PHQW RI ,QWUXVLRQ 'HWHFWLRQ 6\VWHPV ,'6  7KHVH V\VWHPV UHSUHVHQW D QRYHODSSURDFKWRWKHSUREOHPDQGDUHDWWUDFWLQJWKH DWWHQWLRQ RI D JURZLQJ QXPEHU RI UHVHDUFKHUV LQ WKH ILHOG &RQVHTXHQWO\ QHZ DUFKLWHFWXUDO GHVLJQV DUH EHLQJ SURSRVHG DQG IODZV LQ H[LVWLQJ RQHV DUH EHLQJ WDFNOHG ,Q WKLV SDSHU ZH SURSRVH VXFK DQ DUFKLWHFWXUH WKDW DWWHPSWV WR DYRLG VRPH RI WKH FRPPRQ SLWIDOOV RI VXFK V\VWHPV DQG SURYLGH HIILFLHQW VROXWLRQV WR ZHOONQRZQ SUREOHPV :H FRQVLGHU VHFXULW\ PDQDJHPHQW DQ LQWHJUDO SDUW RI QHWZRUN DQG V\VWHPV PDQDJHPHQW DQG WKHUHIRUH ZH WU\WREULGJHWKHJDSEHWZHHQWKHPE\LQFRUSRUDWLQJ WUDGLWLRQDO 1HWZRUN 0DQDJHPHQW 6\VWHP 106 GHVLJQ HOHPHQWV LQWR RXU ,'6 0RUH VSHFLILFDOO\ ZH SURSRVH D V\VWHP ZLWK D GLVWULEXWHG DUFKLWHFWXUH WKDW FRQVLVWVRIHQWLWLHVVXFKDVFROOHFWRUVDQGDQDO\]HUVRI YDULRXV OHYHOV DQG ZKLFK XVHV 6103Y VHPDQWLFV IRUWKHLQWHURSHUDWLRQEHWZHHQWKHP:HEHOLHYHWKDW WKH LQWHJUDWLRQ RI LQWUXVLRQ GHWHFWLRQ DQG QHWZRUN PDQDJHPHQW V\VWHPV ZLOO IDFLOLWDWH VHFXULW\ PDQDJHPHQW LQ ODUJH FRPSXWHU QHWZRUNV VLQFH LW DOORZV WKH OHYHUDJLQJ RI H[LVWLQJ LQIUDVWUXFWXUH DQG SURYLGHVDXQLILHGYLHZRIQHWZRUNVHFXULW\VWDWXVWR WKHPDQDJHU ,,1752'8&7,21 ,QWUXVLRQ 'HWHFWLRQ LV D UHODWLYHO\ QHZ DSSURDFK WR VDIHJXDUGLQJ WKH RSHUDWLRQ RI FRPSXWHU V\VWHPV DQG QHWZRUNV >@ 2SSRVLWH WR WKH WUDGLWLRQDO SURDFWLYH DFFHVV FRQWURO DQG ILUHZDOO EDVHG PHWKRGV LQWUXVLRQ GHWHFWLRQV\VWHPVXVHDUHDFWLYHDQGSUHIHUDEO\UHDO WLPH DSSURDFK WR SURYLGH D VHQVH RI VHFXULW\ LQ H[LVWLQJ FRPSXWHU V\VWHPV ,W LV EDVHG RQ WKH DVVXPSWLRQ WKDW LW LV SUDFWLFDOO\ LPSRVVLEOH WR DYRLG HYHU\VHFXULW\EUHDFKLQWKHORQJUXQDQGHPSKDVL]HV LQVWHDG WKH QHHG WR LGHQWLI\ SUHIHUDEO\ LQ UHDO WLPH

VXFK DWWHPSWV DQG WR DVVHVV WKH GDPDJH WKH\ KDYH FDXVHG 7KLV SDUDGLJP WULHV WR GHWHFW LQWUXVLYH DFWLYLW\E\XWLOL]LQJSDWWHUQPDWFKLQJDOJRULWKPVDQG GHYLDWLRQV IURP GHYLVHG VWDWLVWLFDO PHWULFV WKDW PHDVXUHLQGLFDWLRQVRIFRPSXWHULQWUXVLRQ 7KHUH DUH WZR PDLQ FODVVLILFDWLRQV RI LQWUXVLRQ GHWHFWLRQ V\VWHPV 7KH ILUVW RQH GLYLGHV WKH WHFKQLTXHVRILQWUXVLRQGHWHFWLRQLQWRWZRPDLQW\SHV DQRPDO\ DQG PLVXVH GHWHFWLRQ 7KH DQRPDO\ GHWHFWLRQ PRGHO GHYLVHV D VHW RI VWDWLVWLFDO PHWULFV WKDWPRGHOWKHEHKDYLRURIDQHQWLW\XVXDOO\DXVHUD JURXS RI XVHUV RU D KRVW FRPSXWHU 7KH SURILOH RI D XVHUHQWLW\IRULQVWDQFHPD\LQFOXGHLQIRUPDWLRQVXFK DVWKHPHDQGXUDWLRQRIKLVWHOQHW DQG )73 VHVVLRQV WKHDPRXQWRIE\WHVWUDQVPLWWHGLQERWKGLUHFWLRQVWKH WLPHRIGD\RUWKHWHUPLQDOVKHXVXDOO\ORJVLQIURP HWF 7KH SURILOH RI D KRVW FRPSXWHU PD\ LQFOXGH WKH DYHUDJH &38 XWLOL]DWLRQ WKH DYHUDJH QXPEHU RI ORJJHGLQ XVHUV DQG VR RQ 7KH ,'6 PRQLWRUV WKH RSHUDWLRQ RI D FRPSXWHU V\VWHP DQG FRQVWDQWO\ FRPSDUHV WKH SURILOH RI D FXUUHQW XVHU VHVVLRQ IRU H[DPSOHZLWKWKHRQHVWRUHGLQLWVGDWDEDVH,QFDVHLW GHWHFWVDODUJHGHYLDWLRQIURPWKHQRUPDOEHKDYLRU LWVLJQDOVDQDODUPWRWKHV\VWHPVHFXULW\RIILFHU7KH PDJQLWXGH RI D ODUJH GHYLDWLRQ LV GHILQHG DV D WKUHVKROG VHW E\ WKH ,'6 RU WKH V\VWHP VHFXULW\ RIILFHU 8VXDOO\ WKH VWRUHG SURILOHV DUH FRQVWDQWO\ EHLQJ XSGDWHG LQ RUGHU WR UHIOHFW FKDQJHV LQ XVHU RU V\VWHP EHKDYLRU 6LQFH WKLV PRGHO ZRUNV E\ VHDUFKLQJIRUVHVVLRQVWKDWDUHQRWQRUPDOLWLVFDOOHG DQDQRPDO\GHWHFWLRQPRGHO 7KHPLVXVHGHWHFWLRQPRGHORQWKHRWKHUKDQGZRUNV E\VHDUFKLQJIRUDVHWRINQRZQDWWDFNVWKDWKDYHEHHQ VWRUHGLQWKHV\VWHP VGDWDEDVH7KHNQRZOHGJHRIWKH DWWDFNVLVHQFRGHGDVDVHWRIDWWDFNVLJQDWXUHVZKLFK DUHHVVHQWLDOO\SDWWHUQVWKDWRFFXUHYHU\WLPHDQDWWDFN WDNHVSODFH7KHZD\DNQRZQDWWDFNLVUHSUHVHQWHGWR WKH V\VWHP LV DQ LPSRUWDQW FKDUDFWHULVWLF RI LWV RSHUDWLRQ 7KH YDULDWLRQV LQFOXGH YDULRXV W\SHV RI JUDSKVUHJXODUH[SUHVVLRQVHWF7KHZD\WKLVPRGHO ZRUNVLVVLPLODUWRWKDWRIDQDQWLYLUXVSURJUDP7KH LPSOHPHQWDWLRQ RI VXFK DQ ,'6 XVXDOO\ LQYROYHV DQ H[SHUWV\VWHPWKDWSHUIRUPVWKHPDWFKLQJDJDLQVWWKH VWRUHG UXOHEDVH $Q REYLRXV GLIILFXOW\ LQ WKLV DUFKLWHFWXUH LV WKH QHHG IRU FRQVWDQW XSGDWLQJ RI WKH

PRQLWRULQJDQGVFDODELOLW\:HXVHWHFKQLTXHVIRXQG LQ ERWK KRVWEDVHG DQG QHWZRUNEDVHG ,'6 LQ RUGHU WR HQDEOH WKH V\VWHP WR UHDFK D VRXQG FRQFOXVLRQ EDVHG RQ WKH FRUUHODWLRQ RI ERWK W\SHV RI HYHQWV ,Q RUGHU WR LQWHJUDWH ERWK DSSURDFKHV WKH SURSRVHG V\VWHP XWLOL]HV GDWD JDWKHUHG IURP YDULRXV DXWRQRPRXV DJHQWV >@ WKDW HLWKHU VFDQ WKURXJK WKH KRVW V\VWHP DXGLW WUDLOV IRU NQRZQ LQWUXVLRQ VLJQDWXUHV RU PRQLWRU QHWZRUN WUDIILF IRU VXVSLFLRXV DFWLYLW\ ,Q DGGLWLRQ WKHVH DJHQWV FRPPXQLFDWH ZLWK WUDGLWLRQDO QHWZRUN PDQDJHPHQW DJHQWV LQ RUGHU WR VWDUW VWRS EH UHFRQILJXUHG RU UHQHZHG ZKHQ QHFHVVDU\

UXOHEDVH DV QHZ DWWDFN PHWKRGV EHFRPH NQRZQ 6LQFH WKH PRGHO RSHUDWHV E\ VHDUFKLQJ IRU SDWWHUQV NQRZQWRUHSUHVHQWVHFXULW\DWWDFNVLWLVUHIHUUHGWRDV DPLVXVHGHWHFWLRQPRGHO 7KHVHFRQGFODVVLILFDWLRQLVEDVHGRQZKHWKHUWKH,'6 PRQLWRUVDFWLYLW\RQDVLQJOHKRVWRURQPXOWLSOHKRVWV LQWHUFRQQHFWHG E\ D QHWZRUN 7KH ILUVW LQWUXVLRQ GHWHFWLRQV\VWHPVXVHGWRH[DPLQHWKHDXGLWGDWDRQD VLQJOH PDFKLQH DQG GHULYH WKHLU FRQFOXVLRQV EDVHG VROHO\ RQ WKDW LQIRUPDWLRQ >@ &RQVHTXHQWO\ WKH\ FRXOG QRW GHWHFW DWWDFNV WKDW ZHUH RUFKHVWUDWHG E\ PDQ\VRXUFHVRUDWWDFNVWKDWVSDQPXOWLSOHPDFKLQHV LQ D QHWZRUN )XUWKHUPRUH WKH\ UHO\ KHDYLO\ RQ WKH ORJV SURYLGHG E\ WKH XQGHUO\LQJ RSHUDWLQJ V\VWHP ZKLFKUHQGHUVWKHPDUFKLWHFWXUHGHSHQGHQWDQGPRUH YXOQHUDEOH WR 'HQLDO RI 6HUYLFH DWWDFNV DJDLQVW WKH ,'6 VLQFH DQ LQWUXGHU PD\ PDQDJH WR GHOD\ WKH ORJJLQJPHFKDQLVPRUHYHQWXUQLWRIIDOWRJHWKHU$Q HIILFLHQW VROXWLRQ LV SURYLGHG E\ WKH ,'6 WKDW SDVVLYHO\PRQLWRUWKHQHWZRUNIRUVXVSLFLRXVDFWLYLW\ >@ 6LQFH WKH\ GHSHQG VROHO\ RQ WKH XELTXLWRXV 7&3,3SURWRFROVXLWHWKH\DUHOLWHUDOO\DUFKLWHFWXUH LQGHSHQGHQW DQG WKH\ FDQ PRQLWRU KHWHURJHQHRXV QHWZRUNV TXLWH QDWXUDOO\ $QG ZLWK WKH FXUUHQW WUHQG WRZDUGVJOREDOLQWHUQHWZRUNLQJDOPRVWHYHU\VHFXULW\ DWWDFNLQYROYHVPRUHRUOHVVWKHQHWZRUN

,QRUGHUWRILOWHULQWUXVLRQGHWHFWLRQHYHQWVLQDODUJH LQWHUQHWZRUN HQYLURQPHQW ZH SURSRVH D GLVWULEXWHG DUFKLWHFWXUHEDVHGRQWKH6103YSURWRFRO >@ :H XVH D QXPEHU RI VHQVRUV WR FROOHFW DXGLW GDWD LQ DQ DSSURSULDWHO\ GHVLJQHG 0,% /RFDO DJHQWV SHUIRUP LQLWLDO VFDQQLQJ DFFRUGLQJ WR VSHFLILF LQVWUXFWLRQV SDVVHG IURP D KLJKHU OHYHO PDQDJLQJ SURFHVV 7KH KLJKHU OHYHO HQWLWLHV SHUIRUP PRUH DGYDQFHG VFDQQLQJLQRUGHUWRGHWHFWLQWUXVLRQVRUFKHVWUDWHGE\ PDQ\VRXUFHVDQGWDUJHWLQJPDQ\KRVWV 7KH PDLQ GHVLJQ UHTXLUHPHQWV IRU 6,'6 ZHUH D GLVWULEXWHG DUFKLWHFWXUH FRQIRUPDQFH WR FXUUHQW VWDQGDUGV H[WHQVLELOLW\ DQG VFDODELOLW\ 7KHVH FKDUDFWHULVWLFV SURYLGH LW ZLWK D QXPEHU RI DGYDQWDJHV QDPHO\ UHOLDELOLW\ GLVWULEXWLRQ RI LQWHOOLJHQFH HDV\ GHSOR\PHQW DQG H[WHQVLRQ ILWQHVV WRDZLGHVFDOHRIQHWZRUNV “ 5HOLDELOLW\ VLQFH WKH DUFKLWHFWXUH RI WKH V\VWHP FRQVLVWV RI D QXPEHU RI ORRVHO\ FRXSOHG HQWLWLHV GLVWULEXWHG DFURVV D QHWZRUN WKH ,'6 KDV QR VLQJOH SRLQW RI IDLOXUH ,Q VRPH WULYLDO FRQILJXUDWLRQV RI FRXUVH WKLV PD\ QRW EH WUXH )RU LQVWDQFH FRQVLGHU D VPDOO FRPSDQ\ QHWZRUN FRQVLVWLQJ RI D VLQJOH /$1 ZLWK WHQ KRVWV LQ DQ (WKHUQHW VHJPHQW ,Q VXFK D FDVH LW FRXOG EH UHDVRQDEOHWRGHSOR\DVLQJOHDQDO\]HUDQGXSWR WKUHHFROOHFWRUVRQWKHVHUYHUVEXWWKHQDJDLQLQ VXFKDVHWXSWKHVL]HRIWKHSUREOHP¶VVROXWLRQLV IDUWRRVPDOOWRPDNHDGLIIHUHQFH “ 'LVWULEXWLRQ RI LQWHOOLJHQFH HYHU\ HQWLW\ LQ WKH DUFKLWHFWXUHWKDWLVFROOHFWRUVDQGDQDO\]HUVKDYH WKHLQWHOOLJHQFHWRUHDFKFRQFOXVLRQV±DOEHLWRID GLIIHUHQW OHYHO 7KHUHIRUH WKH ORDG RQ H[LVWLQJ FRPSXWHUHTXLSPHQWLVQRWVXEVWDQWLDOO\DIIHFWHG VRPHWKLQJ WKDW VDWLVILHV RQH RI WKH EDVLF GHVLJQ SULQFLSOHV RI DQ ,'6 )XUWKHUPRUH FROOHFWRUV FRXOGRSHUDWHXQGHUOLWWOHRUQRVXUYHLOODQFHDQG DQDO\]HUV FRXOG SHUIRUP LQWUXVLRQ VHDUFKHV ZLWK KLVWRULFDO GDWD UHQGLQJ QHWZRUN RXWDJH D QRQ FULWLFDOSUREOHP “ (DV\ GHSOR\PHQW DQG H[WHQVLRQ QHWZRUN DGPLQLVWUDWRUVFDQWDNHXSWKHUHVSRQVLELOLWLHVRI VHFXULW\ RIILFHUV ZLWKRXW KDYLQJ WR FRPSUHKHQG QHZ SURWRFROV RU RSHUDWLRQDO VHPDQWLFV 7KH LQWHUFRQQHFWLRQ SURWRFRO EHWZHHQ WKH V\VWHP¶V

$QRWKHU LVVXH IDFHG E\ PRVW DUFKLWHFWXUHV WRGD\ LV VFDODELOLW\0RQROLWKLFRUGLVWULEXWHG,'6>@>@WKDW FROOHFWWKHDXGLWGDWDDQGWUDQVPLWLWWRDFHQWUDOKRVW IRU SURFHVVLQJ DUH LQFDSDEOH RI RSHUDWLQJ LQ D ODUJH HQWHUSULVHQHWZRUNZLWKDYDVWQXPEHURIKRVWV7KH VROXWLRQWRWKLVSUREOHP LQYROYHV WKH FRQVWUXFWLRQ RI WKH,'6WKURXJKDOD\HUHGDUFKLWHFWXUH(YHU\QRGHLQ WKDW PRGHO RSHUDWHV E\ DJJUHJDWLQJ WKH DXGLW GDWD LW UHFHLYHV IURP WKH ORZHU OD\HUV DQG SDVVLQJ D VXPPDUL]HGIRUPWRWKHXSSHUOD\HU7KXVWKHDFWXDO GHWHFWLRQRIDQLQWUXVLRQFDQRFFXURQDQ\OD\HUZLWK WKH VLPSOHU RQHV RFFXUULQJ DW D ORZHU OD\HU DQG WKH DGYDQFHGRQHVDWDKLJKHUOD\HU 7R PHHW WKHVH GHPDQGV ZH GHYHORS D SURWRW\SH V\VWHP FDOOHG 6,'6 6LPSOH ,QWUXVLRQ 'HWHFWLRQ 6\VWHP WKDWIHDWXUHVDKLJKGHJUHHRIVFDODELOLW\DQG HDVH RI LQWHJUDWLRQ ZLWK VWDQGDUG 6103 EDVHG VHH DOVR >@  QHWZRUN PDQDJHPHQW SODWIRUPV 7KH UHVW RI WKH SDSHU LV RUJDQL]HG DV IROORZV VHFWLRQ ,, SURYLGHV DQ DUFKLWHFWXUDO RYHUYLHZ RI WKH SURSRVHG V\VWHP ,Q VHFWLRQ ,,, ZH SUHVHQW WKH DUFKLWHFWXUH RI 6,'6 GHVFULELQJ LQ OHQJWK WKH GLIIHUHQW HQWLWLHV LQYROYHG DV ZHOO DV WKHLU LQWHUFRQQHFWLRQ )LQDOO\ VHFWLRQ,9FRQFOXGHVZLWKDVXPPDU\RIWKHEHQHILWV RIRXUGHVLJQDQGDSUHVHQWDWLRQRIFXUUHQWDQGIXWXUH JRDOV ,,$5&+,7(&785$/29(59,(: 7KHDUFKLWHFWXUHRI6,'6DGGUHVVHVWZRRIWKHDERYH PHQWLRQHGIXQGDPHQWDOSUREOHPVLQWKHILHOGQDPHO\



HVVHQWLDOO\DQ6103DJHQWWKDWPDQDJHVWKH6HQVRUV JDWKHUV WKHLU DXGLW GDWD DQG LPSOHPHQWV WKH KLJKHU OHYHO PDQDJHU¶V LQWUXVLRQ GHWHFWLRQ SROLF\ &RPPXQLFDWLRQ DQG FRQWURO WDNH SODFH WKURXJK WKH XVHRIDQDSSURSULDWHO\GHVLJQHG0,% ,Q WKH QH[W OHYHO ZH KDYH WKH $QDO\]HU WKH PDLQ PDQDJHPHQW DQG WKRURXJK DQDO\VLV V\VWHP IRU HYHU\ GRPDLQ 5HSRUWV DQG GDWD ORJV IURP WKH ORZHU OHYHO &ROOHFWRUV DUH JDWKHUHG KHUH DQG IXUWKHU DQDO\]HG 7KH ODUJH DPRXQW RI LQIRUPDWLRQ DQG WKH RIIOLQH QDWXUH RI WKLV DQDO\VLV SHUPLW WKH XVH RI DGGLWLRQDO PHWKRGV WKDW DWWHPSW WR EXLOG VWDWLVWLFDO SURILOHV IRU QHWZRUN DQG V\VWHP XVDJH RU XVHU EHKDYLRU  GHYLDWLRQ IURP ZKLFK LQGLFDWHV D SRVVLEOH LQWUXVLRQ ,QYHVWLJDWLRQ UHVXOWV DUH HLWKHU UHSRUWHG WR D PDQDJHPHQW FRQVROH RU SDVVHG RQ WR D KLJKHU OHYHO $QDO\]HU WKDW NHHSV WUDFN RI D ODUJHU DGPLQLVWUDWLYH GRPDLQ DQG WKHUHIRUH KDV WKH DELOLW\ WR GLVFRYHU QHWZRUNZLGHDWWDFNSDWWHUQV

HQWLWLHV LV 6103Y VRPHWKLQJ ZKLFK PRVW QHWZRUN DGPLQLVWUDWRUV DUH IDPLOLDU ZLWK $OVR DGGLWLRQDO VHQVRUV DQG FRUUHVSRQGLQJ GHWHFWLRQ UXOHV DUH IDLUO\ VWUDLJKWIRUZDUG WR LPSOHPHQW VKRXOGVRPHRQHZLVKWRFROOHFWDQGDQDO\]HGDWD IURPDQRYHOVRXUFH “ )LWQHVV WR D ZLGH VFDOH RI QHWZRUNV PDQ\ LQWUXVLRQ GHWHFWLRQ V\VWHPV VXIIHU IURP WKH LQDELOLW\WRVFDOHZHOO7KHUHDVRQIRUWKLVLVWKDW WKHLU GHVLJQ GLFWDWHV WKDW GDWD DQDO\VLV LV VHSDUDWHG IURP GDWD FROOHFWLRQ ZLWK WKH IRUPHU EHLQJ FRQGXFWHG LQ D FHQWUDO ZRUNVWDWLRQ 2XU GHVLJQ IROORZV FORVHO\ WKH DUFKLWHFWXUH RI WKH 1HWZRUN¶V0DQDJHPHQW6\VWHPZKLFKFDQVFDOH DORQJ WKH FRPSDQ\¶V QHWZRUN VL]H DQG FRPSOH[LW\ 7KH GHVLJQ RI 6,'6 ERUURZV FRQFHSWV IURP PDQ\ ROGHU ,QWUXVLRQ 'HWHFWLRQ 6\VWHPV EXW HVSHFLDOO\ IURP WKH VXJJHVWLRQV RQ WKH XVDJH RI $XWRQRPRXV $JHQWVIRU,'V\VWHPVLQ>@WKHVFDODELOLW\RI*U,'6 >@ DQG WKH UHTXLUHPHQWV RI ,(7)¶V ,QWUXVLRQ 'HWHFWLRQ 0HVVDJH ([FKDQJH )RUPDW ,':*  >@ ZKLFK LV D VWDQGDUGL]DWLRQ HIIRUW WKDW LQ D VHQVH KDV VXFFHHGHG WKH &RPPRQ ,QWUXVLRQ 'HWHFWLRQ )UDPHZRUN&,') >@

%7KH&ROOHFWRU &ROOHFWRUV FRQWDLQ D &RQWUROOHU DQG D QXPEHU RI 6HQVRUV7KH 6HQVRUV DUH DXWRQRPRXV SURFHVVHV WKDW SHUIRUP WKH DFWXDO GDWD FROOHFWLRQ HDFK RQH LQ LWV RZQ VSHFLILF DXGLW GRPDLQ 7KH\ FDQ EH VWDUWHG VWRSSHG UHFRQILJXUHG RU XSGDWHG E\ WKH &RQWUROOHU 7KH DXGLW GDWD LV VWRUHG LQ WKH &RQWUROOHU ZKLFK LQFRUSRUDWHVDQ6103DJHQWWKDWFRPPXQLFDWHVZLWK WKH $QDO\]HU 7KH GDWD DV ZHOO DV WKH 6HQVRUV¶ FRQILJXUDWLRQLQIRUPDWLRQLVVWRUHGLQD0,%WKDWFDQ EH DFFHVVHG E\ WKH $QDO\]HU 7KH &RQWUROOHU LWVHOI SHUIRUPVDSUHOLPLQDU\DQDO\VLVRIWKHGDWDEDVHGRQ HOHPHQWDU\ UXOHV VSHFLILHG LQ WKH 0,% )LJXUH  SUHVHQWV WKH DUFKLWHFWXUH RI WKH &ROOHFWRU HQWLW\ LQ PRUHGHWDLO

,,,6,'6$5&+,7(&785( 7KH DUFKLWHFWXUH RI 6,'6 FRQVLVWV RI YDULRXV OHYHOV HDFK ZLWK LWV RZQ IXQFWLRQDOLW\ DQG DV PHQWLRQHG EHIRUH LW IROORZV FORVHO\ WKH QHWZRUN PDQDJHPHQW VFKHPH $Q RYHUYLHZ LV JLYHQ LQ ILJXUH  DQG HODERUDWHGEHORZ 'RPDLQ(QWHUSULVH $OHUWV +LJKHU/HYHO

$QDO\VHU

6,'6 $QDO\]HUV

$QDO\VLV5XOHV

/$1$OHUWV

6HQVRU&RQWURO,QVWUXFWLRQV &RQWURO0HVVDJHV

(YHQW5HSRUWV 'DWD/RJV

5HTXHVWVIRU'DWD VW/HYHO6,'6

)LOWHU5XOHV

$QDO\]HU

&

Q WU

([HFXWLRQ

O O HU

&RQWURO 'DWD/RJV

6103$JHQW

,QVWUXFWLRQV

$OHUWV

0,% 3UHOLPLQDU\'DWD$QDO\VLV 6,'6+RVW

6,'6+RVW

6,'6+RVW

&ROOHFWRU

&ROOHFWRU

&ROOHFWRU

/$1 +RVW'DWD

+RVW'DWD

+RVW'DWD

'DWD /RJV

6HQVRU

6HQVRU

6HQVRUQ

)LJXUH*HQHUDO$UFKLWHFWXUH &ROOHFWRU

$*HQHUDODUFKLWHFWXUH 6,'6FRQVLVWVRIWZRW\SHVRIHQWLWLHVFROOHFWRUVWKDW JDWKHUWKHDXGLWGDWDDQGDQDO\]HUVWKDWVFDQWKHPIRU LQWUXVLYHEHKDYLRU$WWKHORZHVWOHYHOZHGHILQHWKH &ROOHFWRU $ EDVLF RU IXOO\IOHGJHG &ROOHFWRU LV LQVWDOOHG LQ HYHU\ KRVW ZH LQFOXGH LQ WKH 6,'6 DUFKLWHFWXUH ,WV PDLQ SDUWV DUH D QXPEHU RI $XWRQRPRXV $JHQWV RU 6HQVRUV DQG WKH &RQWUROOHU

)LJXUH7KH&ROOHFWRU

0RUH VSHFLILFDOO\ WKH SDUWV RI WKH &ROOHFWRU DUH DV IROORZV



DIIHFWLQJLWVSHUIRUPDQFHLQDJUHDWHURUOHVVHUH[WHQW ,Q RXU SURSRVHG DUFKLWHFWXUH RQH SUREDEO\ GHGLFDWHG V\VWHPFRQWDLQVD&ROOHFWRUWKDWSOD\VWKH UROH RI WKH QHWZRUN VHQVRU 7KH UHVW RI WKH V\VWHPV FRQWDLQ&ROOHFWRUVWKDWJDWKHULQIRUPDWLRQFRQFHUQLQJ RQO\WKHRSHUDWLRQRIWKHVSHFLILFV\VWHPDQGUHSRUWLW WR WKH $QDO\]HU 7KH ODWWHU FDQ FRPELQH UHSRUWV RI QHWZRUNDFWLYLW\ILUVWOHYHO DOHUWV DQG FRUUHODWH WKHP ZLWKWKHYDULRXVKRVWRSHUDWLRQDOFKDUDFWHULVWLFVHJ &38XVDJHXVHUDFWLRQVIDLOHGORJLQVHWF 

7KH6HQVRUV 7KLVVXEV\VWHPFRQVLVWVRIDQ\QXPEHURIDXGLWGDWD FROOHFWRU DQG SRVVLEO\ YHU\ SUHOLPLQDU\ DQDO\VLV SURFHVVHVWKDWRSHUDWHLQWKHV\VWHP7KHVHSURFHVVHV LQ WKHLU VLPSOHVW IRUP FDQ EH EDVLF V\VWHP DQGRU QHWZRUN VXUYHLOODQFH SURJUDPV RU HYHQ LQFOXGH FRPPHUFLDOWRROV7KHLURSHUDWLRQLVPDQDJHGE\WKH &RQWUROOHUDFFRUGLQJWRYDULRXVSDUDPHWHUVVHWLQWKH 6103 DJHQW¶V 0,% 0RUH VSHFLILFDOO\ YDULRXV LQVWDQFHVRIWKHDJHQWV FDQ EH VWDUWHG ZLWK GLIIHUHQW H[HFXWLRQ FKDUDFWHULVWLFV HDFK WLPH  ZH FDQ FRQILJXUH D PLQLPXP QXPEHU RI LQVWDQFHV UXQQLQJ HDFK WLPH DQG WKHUH LV D FKHFN SHULRG WR HQVXUH WKDW WKHVHQVRUVUHPDLQLQRSHUDWLRQ$OOWKLVHQVXUHVWKDW WKHV\VWHPZLOOPDNHWKHEHVWXVHRIWKHLQGHSHQGHQW QDWXUHRIWKHDXWRQRPRXVDJHQWV

&7KH$QDO\]HU 7KH $QDO\]HUV FRQVLVW RI D FRPPXQLFDWLRQV PRGXOH D GDWD UHSRVLWRU\ D UXOH EDVH D QHWZRUN WRSRORJ\ EDVHDQLQIHUHQFHHQJLQHDQGDYLVXDOL]DWLRQPRGXOH +LJKHUOHYHO

:H KDYH PHW WKH SUREOHP RI LQWHUFRQQHFWLQJ WKH &RQWUROOHU ZLWK WKH YDULRXV 6HQVRUV E\ GHILQLQJ JHQHULFXVDJHVHPDQWLFVLQWKH0,%)RUHDFK6HQVRU LQVWDOOHG WKH QXPEHU RI RXWSXW LWHPV DQG WKHLU FRUUHVSRQGLQJ W\SHV DUH GHFODUHG 7KH $QDO\]HU KDV WKXVWKHRSSRUWXQLW\WRNQRZQRWRQO\ZKLFK6HQVRUV KDYH EHHQ LQVWDOOHG EXW DOVR WKHLU VSHFLILF FKDUDFWHULVWLFV DQ LQIRUPDWLRQ WKDW FDQ DLG LQ WKH GHILQLWLRQRIDQDO\VLVUXOHV

$QDO\VHUV

/$1$OHUWV

& PPXQLFDWL QV 



XOH

WKHU

(YHQW&RQFOXVLRQV

9LVXDOL]DWLRQ 0RGXOH 0DQDJHU &RQVROH

$QDO\VLV

,QIHUHQFH(QJLQH

2SHUDWRU

5XOHV 1HWZRUN

7KH DXWRQRPRXV DJHQW ELQDULHV FDQ EH LQVWDOOHG RII OLQH LQ WKH V\VWHP E\ WKH ORFDO DGPLQLVWUDWRU DQG EH FKHFNHG WR HQVXUH WKDW WKH\ KDYH QRW EHHQ WDPSHUHG ZLWK 7KH DXGLW GDWD WKH\ KDYH FROOHFWHG LV VWRUHG LQ WKH0,%

7RSRORJ\

$V\QFKURQRXVDOHUWV IURP6103WUDSV

/RJ 5HSRVLWRU\ 61030RGXOH

$QDO\]HU

7KH&RQWUROOHU 7KLVLVPDLQO\WKHLPSOHPHQWDWLRQRIDQ6103DJHQW LQVWDOOHGLQHYHU\KRVW,WLVXVHGIRUEDVLFDQDO\VLVRI WKH JDWKHUHG GDWD SDVVLQJ PDQDJHPHQW LQIRUPDWLRQ WRWKH6HQVRUVDQGWUDQVPLWWLQJXSRQ6103UHTXHVW WKH DXGLW GDWD WR WKH $QDO\]HU IRU IXUWKHU VWXG\ ,WV 0,%LVXVHGERWKDVDGDWDUHSRVLWRU\VWUXFWXUHDQGD SODFH ZKHUH WKH $QDO\]HU VHWV FRQWURO SDUDPHWHUV DIIHFWLQJ WKH RSHUDWLRQ RI DOO VHQVRUV WKH EDVLF DQDO\VLVDQGWKHDOHUWWULJJHUV

$QDO\VLV5XOHV 6HQVRU&RQWURO,QVWUXFWLRQV

(YHQW5HSRUWV 'DWD/RJV

5HTXHVWVIRU'DWD

&ROOHFWRUV

)LJXUH'HWDLOHG$QDO\]HU$UFKLWHFWXUH

7KHFRPPXQLFDWLRQVPRGXOHLVXVHGWRFRPPXQLFDWH ZLWK &ROOHFWRUV DQG RWKHU $QDO\]HUV LQ D PXOWLOHYHO FRQILJXUDWLRQ 7KH GDWD UHSRVLWRU\ VWRUHV KLVWRULFDO GDWD FROOHFWHG IURP &ROOHFWRUV RU VXERUGLQDWH $QDO\]HUV 7KH UXOH EDVH FRQWDLQV WKH UXOHV WKDW DUH DSSOLHGDJDLQVWWKHDXGLWGDWDDQGWULJJHUWKHLQWUXVLRQ DOHUWV 7KH QHWZRUN WRSRORJ\ EDVH FRQWDLQV LQIRUPDWLRQ SURYLGHG E\ WKH QHWZRUN DGPLQLVWUDWRU WKDWGHVFULEHVWKHVSHFLILFLQVWDOODWLRQ7KH LQIHUHQFH HQJLQHSHUIRUPVWKHDFWXDO PDWFKLQJ RI UXOHV DJDLQVW DXGLWGDWD)LQDOO\WKH YLVXDOL]DWLRQ PRGXOH SURYLGHV WKH QHWZRUN PDQDJHU ZLWK D XVHUIULHQGO\ DQG FRQWHQWULFKYLHZRIWKHFXUUHQWVHFXULW\VWDWXVRIWKH QHWZRUN /DUJH HQWHUSULVH QHWZRUNV ZLWK PXOWLSOH DGPLQLVWUDWLYH GRPDLQV FDQ XVH D PXOWLOHYHO FRQILJXUDWLRQ LQ ZKLFK WKH $QDO\]HUV RI D KLJKHU OHYHOZLOO SHUIRUP WKHLU DQDO\VLV RQ GDWD SURYLGHG WR WKHPE\WKHORZHUOHYHO$QDO\]HUV

7KH DQDO\VLV UXOHV DW WKH &RQWUROOHU SHUIRUP D EDVLF ILOWHULQJ RI WKH DXGLW GDWD WU\LQJ WR GLVFRYHU LQGLFDWLRQV RI IDLUO\ VLPSOH PLVXVH VLJQDWXUHV :KHQ WKHUHLVDSRVLWLYHLQGLFDWLRQRIVXFKDQHYHQWWKHGDWD LQ TXHVWLRQ LV PDUNHG DV VXVSLFLRXV 7KLV FDQ JLYH WKHPKLJKHUSULRULW\DQGDWWHQWLRQLQWKHVHFRQGOHYHO LQYHVWLJDWLRQ$OVRD QRWLILFDWLRQ XVLQJ 6103¶V WUDS RULQIRUPUHTXHVWVLVFRQYH\HGDVDQXUJHQWPHVVDJH WRWKHXSSHUOHYHOSRVVLEO\SURPSWLQJDSURJUDPPHG UHVSRQVHRUMXVWDOWHULQJWKHLQYHVWLJDWLRQSURFHVV :KHQWKHV\VWHPLVGHSOR\HGLQD/$1HDFKKRVWRU D QXPEHU RI WKHP  KDV D &ROOHFWRU WKDW LQFOXGHV WKH &RQWUROOHU DQG LPSOHPHQWV IXOO\ RU LQ SDUW WKH 0,% VWUXFWXUH 0RUHRYHU LQ DFFRUGDQFH ZLWK WKH DPRXQW RILQIRUPDWLRQUHTXLUHGWREHJDWKHUHGLQHDFKVWDWLRQ WKHUH PD\ EH GLIIHUHQW DXWRQRPRXV DJHQWV LQVWDOOHG



'0XOWLOHYHO$QDO\VLV

>@ 7HUHVD /XQW HW DO ,'(6 7KH HQKDQFHG SURWRW\SH7HFKQLFDOUHSRUW65,,QWHUQDWLRQDO &RPSXWHU6FLHQFH/DE2FWREHU >@ - &DVH 5 0 XQG\ ' 3DUWDLQ % 6WHZDUW ,QWURGXFWLRQ WR 9HUVLRQ  RI WKH ,QWHUQHW VWDQGDUG 1HWZRUN 0DQDJHPHQW )UDPHZRUN 7KH,QWHUQHW6RFLHW\5)&$SULO >@ / 7 +HEHUOHLQ HW DO $ QHWZRUN VHFXULW\ PRQLWRU 3URFHHGLQJV RI WKH ,((( 6\PSRVLXP RQ5HVHDUFKLQ6HFXULW\DQG3ULYDF\2DNODQG &$0D\ >@ 6 5 6QDSS HW DO $ V\VWHP IRU GLVWULEXWHG LQWUXVLRQ GHWHFWLRQ 3URFHHGLQJV RI WKH ,((( &203&21  6DQ )UDQFLVFR &$ )HEUXDU\  >@ 0 DUN &URVELH *HQH 6SDIIRUG 'HIHQGLQJ D &RPSXWHU 6\VWHP XVLQJ $XWRQRPRXV $JHQWV 7HFKQLFDO UHSRUW 1R  &2$67 /DERUDWRU\'HSDUWPHQWRI&RPSXWHU6FLHQFHV 3XUGXH8QLYHUVLW\0DUFK >@ - 6 %DODVXEUDPDQL\DQ -2 *DUFLD )HUQDQGH] ' ,VDFRII ( 6SDIIRUG ' =DPERQL $Q $UFKLWHFWXUH IRU ,QWUXVLRQ 'HWHFWLRQ XVLQJ $XWRQRPRXV $JHQWV 7HFKQLFDO 5HSRUW  &2$67 /DERUDWRU\ 3XUGXH8QLYHUVLW\-XQH >@ 6 6WDQLIRUG&KHQ 6 &KHXQJ 5 &UDZIRUG 0  'LOJHU - )UDQN - +RDJODQG . /HYLWW &:HH5@ . -DFNVRQ ' 'X%RLV & 6WDOOLQJV $Q H[SHUW V\VWHP DSSOLFDWLRQ IRU QHWZRUN LQWUXVLRQ GHWHFWLRQ3URFHHGLQJVRIWKHWK'HSDUWPHQW RI (QHUJ\ &RPSXWHU 6HFXULW\ *URXS &RQIHUHQFH >@ ) 6WDPDWHORSRXORV * .RXWHSDV % 0 DJODULV 6\VWHP 6HFXULW\ 0DQDJHPHQW YLD 6103 3URFHHGLQJV RI WKH WK +3298$ :RUNVKRS RQ 1HWZRUN DQG 6\VWHPV 0DQDJHPHQW0DGULG6SDLQ$SULO >@ &RPPRQ ,QWUXVLRQ 'HWHFWLRQ )UDPHZRUN &,') KWWSRO\PSXVFVXFGDYLVHGXFLGI >@ ,(7)¶V,QWUXVLRQ'HWHFWLRQ([FKDQJH)RUPDW :RUNLQJ*URXS,':* KWWSZZZLHWIRUJKWPOFKDUWHUVLGZJ FKDUWHUKWPO

7KH 6,'6 DUFKLWHFWXUH FDQ VFDOH IXUWKHU XS WUDQVPLWWLQJ WKH PLGGOH OHYHO $QDO\]HU UHSRUWV WR D KLJKHU OHYHO DQDO\]LQJ HQWLW\ 2QH REYLRXV DSSOLFDWLRQ ZRXOG EH WR YLVXDOL]H WKH VHFXULW\ VWDWXV RYHU YDULRXV GRPDLQV SHUKDSV LQ DQ HQWHUSULVH RU FRXQWU\ZLGHVFDOH$GGLWLRQDOO\QHZPHWKRGVRIORJ DQDO\VLV FDQ EH LPSOHPHQWHG GHVLJQHG WR UHYHDO ZLGHUVFDOHLQWUXVLRQSDWWHUQVEXWLQWKLVFDVHWKHGDWD WUDQVIHU ZLOO KDYH WR EH OLPLWHG XVLQJ VXPPDUL]HG GDWD WR DYRLG LQFUHDVLQJ WKH QHWZRUN ORDG RU HYHQ FDXVLQJ FRQJHVWLRQ 7KH IXQFWLRQDOLW\ DQG EHQHILW RI VXFK D KLJKHU OHYHO LQWHURSHUDELOLW\ UHTXLUHV IXUWKHU VWXG\ ,9&21&/86,216)8785(:25. :H SUHVHQWHG WKH GHVLJQ RI DQ ,QWUXVLRQ 'HWHFWLRQ 6\VWHPWKDWIHDWXUHVDKLJKGHJUHHRI VFDODELOLW\ DQG HDVH RI LQWHJUDWLRQ ZLWK VWDQGDUG QHWZRUN PDQDJHPHQW SODWIRUPV :H SURSRVH D JHQHUDO DUFKLWHFWXUH WKDW XVHV WKH SURYHQ FRQFHSWV RI 6103 DQG DXWRQRPRXV DJHQWV :H EHOLHYH WKDW EHVLGHV LWV PDLQXVHDVDQ,'V\VWHP6,'6GHPRQVWUDWHVDPRUH JHQHULF DSSURDFK IRU WKH LQWHJUDWLRQ FRQWURO DQG PDQDJHPHQW RI DXWRQRPRXV DJHQWV LQ D V\VWHP 7KH FRQFHSWV RI DXWRQRPRXV DJHQW RXWSXW W\SHV GHFODUDWLRQLQWKH0,% DQG UXOH GHILQLWLRQ EDVHG RQ WKHVHW\SHVRIIHUVDVROXWLRQIRUPDQ\RWKHUSUREOHPV RIWKHVDPHNLQG)XUWKHUPRUHZLWKWKHXVHRI6103 WKLVVROXWLRQVFDOHVZHOOLQYDULRXVOHYHOVDFFRUGLQJWR WKHQHHGV :HKDYHILQLVKHGWKHGHVLJQRI WKH 0,% DQG ZH DUH FXUUHQWO\ GHYHORSLQJ WKH FROOHFWRU ZLWK RQH VHQVRU WKDW JDWKHUV GDWD IURP WKH QHWZRUN SDFNDJHV LW LQ D VXPPDU\ IRUPDW DQG VWRUHV LW LQ WKH 0,% ,WV RSHUDWLRQLVVLPLODUWRDQHWZRUNVQLIIHUEXW SULRULW\ LVJLYHQWRWKHGDWDWKDWFDQUHYHDODSRUWVFDQHYHQD VWHDOWKRQH )XWXUHZRUNLQFOXGHVWKHLPSOHPHQWDWLRQ RI WKH DQDO\]HU VSHFLILF GHILQLWLRQ RI WKH UXOH ODQJXDJH DQG GHYHORSPHQW RI DGGLWLRQDO VHQVRUV DFFRPSOLVKLQJ PRUH FRPSOH[ WDVNV 2XU DUFKLWHFWXUH KDV WR EH HYDOXDWHG LQ WHUPV RI GDWD WUDQVSRUW HIILFLHQF\ HIIHFWLYHQHVV RI WKH LQWUXVLRQ GHWHFWLRQ DOJRULWKPV DQG WKH QHWZRUN VHFXULW\ VWDWXV YLVXDOL]DWLRQ:HSODQWRFRQGXFWWKRURXJKWHVWLQJRI WKHV\VWHPXVLQJZHOONQRZQPLVXVHFDVHVDQGVWXG\ WKHEHQHILWVRIDPXOWLOHYHOFRQILJXUDWLRQLQGHWHFWLQJ GRPDLQZLGH LUUHJXODU DFWLYLW\ :H DOVR LQWHQG WR LQYHVWLJDWHSRVVLEOHHQKDQFHPHQWVLQWKHDUFKLWHFWXUH WKDWZLOOEHGLFWDWHGE\WKHSURWRW\SHLPSOHPHQWDWLRQ 5()(5(1&(6 >@ 'RURWK\ ( 'HQQLQJ $Q LQWUXVLRQGHWHFWLRQ PRGHO ,((( 7UDQVDFWLRQV RQ 6RIWZDUH (QJLQHHULQJYRO6(SS)HEUXDU\