Subject: [mile] Fwd: New Version Notification for draft-suzuki-mile-darknet-00.txt

From: Mio SUZUKI <[email-masked]>
Date: Thu, 10 Jul 2014 14:13:35 +0900

Hello all, 

I’d like to inform our draft about schema to exchange 
incident information obtained from darknet monitoring. 
Our alerting system called DAEDALUS currently use this schema 
to send alerts to organizations. 

We think this schema is as-is and not well designed.
We’d like to get all sorts of comments or feedbacks.

http://tools.ietf.org/html/draft-suzuki-mile-darknet-00

I’d like to explain it on next IETF meeting.

Regards,
mio

> From: [email-masked]
> Subject: New Version Notification for draft-suzuki-mile-darknet-00.txt
> Date: 2014年7月5日 2:09:20 JST
> To: "Mio Suzuki" <[email-masked]>, "Masashi Eto" <[email-masked]>, Masashi Eto <[email-masked]>, Mio Suzuki <[email-masked]>, Koji Nakao <[email-masked]>, "Daisuke Inoue" <[email-masked]>, Daisuke Inoue <[email-masked]>, "Koji Nakao" <[email-masked]>
> 
> 
> A new version of I-D, draft-suzuki-mile-darknet-00.txt
> has been successfully submitted by Mio Suzuki and posted to the
> IETF repository.
> 
> Name:		draft-suzuki-mile-darknet
> Revision:	00
> Title:		Incident Information Exchange in Darknet Monitoring System
> Document date:	2014-07-04
> Group:		Individual Submission
> Pages:		9
> URL:            http://www.ietf.org/internet-drafts/draft-suzuki-mile-darknet-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-suzuki-mile-darknet/
> Htmlized:       http://tools.ietf.org/html/draft-suzuki-mile-darknet-00
> 
> 
> Abstract:
>   A darknet is a set of routable but unused IP addresses whose
>   monitoring is an effective way of detecting malicious activities on
>   the Internet.  We have developed an alert system - called DAEDALUS -
>   based-on a large-scale distributed darknet that consists of several
>   organizations that mutually observe the malicious packets transmitted
>   from the inside of the organizations.  This draft shares the schema
>   of an alert of the DAEDALUS to exchange incident information among
>   organizations.
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
>

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Fri, 11 Jul 2014 18:23:47 +0000

Hi Mio,

Even though a useful test case in the security automation area, I don't see how related this is to IODEF or the MILE WG. It seems to be based on its own data model and formats. What it has in common with IODEF is XML representations.

Can you explain how this relates to the MILE WG scope?

Panos

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Mio SUZUKI
Sent: Thursday, July 10, 2014 1:14 AM
To: [email-masked]
Subject: [mile] Fwd: New Version Notification for draft-suzuki-mile-darknet-00.txt

Hello all, 

I’d like to inform our draft about schema to exchange incident information obtained from darknet monitoring. 
Our alerting system called DAEDALUS currently use this schema to send alerts to organizations. 

Regards,
mio

> To: "Mio Suzuki" <[email-masked]>, "Masashi Eto" <[email-masked]>, 
> Masashi Eto <[email-masked]>, Mio Suzuki <[email-masked]>, Koji Nakao 
> <[email-masked]>, "Daisuke Inoue" <[email-masked]>, Daisuke Inoue 
> <[email-masked]>, "Koji Nakao" <[email-masked]>
> 
> 
> A new version of I-D, draft-suzuki-mile-darknet-00.txt has been 
> successfully submitted by Mio Suzuki and posted to the IETF 
> repository.
> 
> Please note that it may take a couple of minutes from the time of 
> submission until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
>

---

From: Mio SUZUKI <[email-masked]>
Date: Mon, 14 Jul 2014 16:43:57 +0900

Hello Panos,

Thank you for your valuable comment. 
As you mentioned, our current data model described in this draft is 
based on the information issued from our DAEDALUS system for 
incident response actions, which is much different from IODEF.

Even though MILE WG is focused on IODEF and RID as written in its charter,
we hope to discuss here because we will get all sorts of comments from
many experts about incident response in MILE WG.

Depending on a result of the discussion, we are considering to redesign our 
data model in the draft as a IODEF suitable form.

Regards,
mio

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Mon, 14 Jul 2014 13:02:23 +0000

Thank you for the clarification.
Panos

-----Original Message-----
From: Mio SUZUKI [mailto:[email-masked]] 
Sent: Monday, July 14, 2014 3:44 AM
To: Panos Kampanakis (pkampana)
Cc: [email-masked]
Subject: Re: [mile] New Version Notification for draft-suzuki-mile-darknet-00.txt

* PGP - S/MIME Signed by an unverified key: 7/14/2014 at 3:43:58 AM

Hello Panos,

Thank you for your valuable comment. 
As you mentioned, our current data model described in this draft is based on the information issued from our DAEDALUS system for incident response actions, which is much different from IODEF.

Even though MILE WG is focused on IODEF and RID as written in its charter, we hope to discuss here because we will get all sorts of comments from many experts about incident response in MILE WG.

Depending on a result of the discussion, we are considering to redesign our data model in the draft as a IODEF suitable form.

Regards,
mio

2014/07/12 3:23、Panos Kampanakis (pkampana) <[email-masked]>：

>> <[email-masked]>, "Daisuke Inoue" <[email-masked]>, Daisuke 
>> Inoue <[email-masked]>, "Koji Nakao" <[email-masked]>
>> 
>> 

* [email-masked] <[email-masked]>
* Issuer: StartCom Ltd. - Unverified

---

From: Mio SUZUKI <[email-masked]>
Date: Tue, 22 Jul 2014 23:34:45 -0400

Hello all,

Thank you for those of you who kindly gave us comments offline.
It seems to be that we had better clarify the relationship of the draft and
MILE WG before tommorow's session.

We are operating a darknet monitoring system, called DAEDALUS, which have
been already deployed by some local governments and companies.
The system issues alerts (in XML) to the contact people of the deployed
organizations. The alerts are used for incident response-related operations 
inside the recipient organizations.

We are aware that IODEF is gaining more popularity nowadays, thus it would
be nice to share our incident reporting format(that we have been using
inside our daily operations) here in MILE and receive honest feedbacks.
Based on the discussion, we would like to consider further development of
our schema; compatibility with IODEF, or extension to IODEF, or just using
IODEF, could be considered.

Best regards,
Mio