This talk describes the selection of an Internet Content Filtering solution suitable for the specific requirements of the Waikato Institute of Technology (Wintec). Product data was collected from a variety of sources including: vendor product datasheets, industry benchmark tests, the experiences of other institutions and the academic literature. The available solutions were compared using the Analytic Hierarchy Process (Saaty 1980), a multicriteria decision support tool, using the above data and priority weightings determined for each criterion

Elrick, Michael

Hunt, Tim D.

Murphy, Kathy

Wickham, Heather

Wintec Research Archive

281281281Proceedings of the 16th Annual NACCQ, Palmerston North New Zealand July, 2003 (eds) Mann, S. and Williamson, A. www.naccq.ac.nzProcess (Saaty 1980), a multicriteria decisionsupport tool, using the above data and priorityweightings determined for each criterion.KeywordsAnalytic Hierarchy Process, SPAM, virus,email, Internet content filtering.1. INTRODUCTIONThe issues of Internet Content Filtering (ICF)are an increasing concern for industrial andeducational organisations that wish to limit theirvolume of non-work related Internet traffic (Burke2002).  Although a large source of this traffic isdue to third parties such as SPAM and viruscreators, the tendency of both employees andstudents to use the Internet for non-work relatedactivities exacerbates the situation.  The Internettraffic generated can be a real cost toorganisations in terms of paying for the traffic,but it can also cause issues such as: virusattacks, time wasted dealing with SPAM email,lost productivity due to non work related browsingand increased down load times for legitimate work.There is also the concern for organisations toprovide a safe working / study environment thatdoes not subject staff or students to ‘passive’viewing of objectionable material: This portraysthe organisation as being unprofessional andpotentially gives grounds for grievance actions by staffor students.  There are numerous potential solutionsfor these issues, each with different methods ofimplementation and cost/maintenance tradeoffs.2. WINTEC ICF REQUIREMENTSPeak Internet traffic levels (Kb/s) at the WaikatoInstitute of Technology (Wintec) are routinely in excessof the 1 Mbps level guaranteed by our network providerunder the current contract (Figure 1a). It is not expectedthat Wintec will fund an increase in guaranteed trafficand so options for reducing the traffic levels are beingassessed to avoid a possible loss of service qualitydue to provider enforced maximum traffic.  Figure 1bshows the average hourly International traffic rates andit is clear that on a per hour basis, the traffic is mostlyless than that guaranteed.  Analysis of Internet trafficindicated that reductions could be achieved by reducingnon – work based activities and unwanted emails(SPAM and emails caused by or containing viruses).Although some manual administration of contentcurrently occurs, it is a time consuming process andcannot be performed at a level that achieves significantInternet traffic reduction.Selection of an Internet ContentFiltering Solution using theAnalytic Hierarchy ProcessTim D. HuntHeather WickhamKathy MurphyMichael ElrickThe Waikato Institute of Technology,Hamilton, NZtim.hunt@wintec.ac.nzABSTRACTThis talk describes the selection of an Internet Content Filtering solution suitable for the specificrequirements of the Waikato Institute of Technology (Wintec).  Product data was collected from a varietyof sources including: vendor product datasheets, industry benchmark tests, the experiences of otherinstitutions and the academic literature.  The available solutions were compared using the Analytic Hierarchy282Figure 1a shows the peak International traffic (during each hour) versus hour of day, for arandomly chosen week in May 2003.  The solid horizontal line indicates the purchasedlevel (1000 Kb/s) and it can be clearly seen that for the majority of the working week day,the traffic peaks are greater than that guaranteed by our network provider.  Figure 1bshows the same data as Figure 1a but averaged on a per hour basis.2832.1 INITIAL CONDITIONS ATWINTECAt the start of this work Wintec already had inplace, a number of ICF strategies, which are describedin the following sections.  Figures 2a and 2b givesimplified views of the Wintec Network.  Whenconsidering the overall strategy of ICF these diagramsprovide a means of planning a system that considersall points of access, infection and control.2.1.1 ANTI VIRUS PROTECTIONCommand Anti-Virus for Windows (CommandSoftware Systems 2003) is installed on individualworkstations and the virus definitions are automaticallyupdated when users log on to the Novell Network, byaccessing an MSWindows Server that in turn obtainsnew definitions from the Command Software FTPServer.  Server versions of Command Anti-Virus areinstalled on Wintec servers and are also updated on aregular basis.  Wintec has a small number of AppleMac computers and they do not have anti virus softwareinstalled.2.1.2 NON WORK RELATEDHTTP TRAFFICFigure 2a shows the location of the two (Staff andStudent) Novell BorderManager (NBM) 3.6 firewalls(Novell 2003) which provide firewall, proxy and cacheservices.  NBM also included the CyberPatrol contentdatabase, for url blocking but this was subsequentlyreplaced (by Novell) with the SurfControl Contentdatabase (SurfControl 2003) during the course of thiswork.2.1.3 SPAM - UNSOLICITEDEMAILThere are currently ongoing discussions at apolitical level to try to reduce the effects of SPAM (seeMetz 2003 for a USA perspective), but regulators havenot yet agreed on a definition of what SPAM is and isnot.At Wintec SPAM is managed using a black listthat filters emails based on the senders address.  Thisprocess is time consuming as the email addresses ofSPAM distributors is continually changing in anattempt to keep ahead of the system administratorsblack lists.  No email filtering based on email subjector body text is being performed.2.1.4 WEB PAGE POPUPSWeb page Popups are becoming an increasingnuisance when viewing web pages.  Wintec has nodata on the quantity of traffic that they create and nocontrol of web page Popups is being carried out.However, popups may become a significant issue andproducts do exist that aim to reduce their prevalence.2.1.5 COMPUTER USE POLICYAND ETHICAL ISSUES OFICFWintec’s computer use policy covers issues suchas deliberate introduction of software and hardwareand deliberate harmful behaviour.  Intentionallyaccessing objectionable material and deliberatelywasting computing resources is not acceptable useof computer facilities.Deciding what is and what is not objectionablematerial is a subject of much debate in the literature.Wintec uses the definition given in Section 3 of theFilms, Videos and Publication Classification Act(1993).  This definition does not cover what many staffmay consider material that would be objectionablewhen viewed in a place of work.3 INITIAL THOUGHTS FOROVERALL STRATEGYThere are a number of possible implementationsof ICF that might be applied.  This section gives theoverview of what they might include.3.1 ANTI VIRUS PROTECTIONThe current level of anti virus software is notconsidered suitable, although at the time ofimplementation it was seen as a sensible choice withthe limited budget that was available and viruses werenot propagating at the rate that they currently do.  Intheory installing anti virus products at the followingphysical/logical locations should provide a high levelof protection:♦ SendMail –All Internet email passes throughthis email product.  As the Internet is seen to be themost likely source of viruses, an anti virus producthere should stop the majority of email viruses enteringthe Wintec network.♦ GroupWise – This is used as the staff emailsystem.  Email that contains a virus can be passedbetween staff without being intercepted by a SendMailanti virus product.♦ Novell Border Manager – Prevent HTTP andFTP based viruses reaching workstations.♦ Servers – All servers are liable to virus infectionand so all servers (including the SendMail, GroupWise284Figure2. A simplified view of the Wintec network a) Physical and b) Logical.  Knowledgeof the network assists with the ICF design by identifying points of access, infection andcontrol.2853.4 NETWORK APPLIANCESHardware products are available that perform anumber of ICF functions and can be installed betweenthe Internet Router and the internal network.  Theseproducts promise the simplicity of just plugging in asingle device that can perform a high level of ICF.They will not be able to deal with internal issues suchas viruses being introduced via Workstations, or willthey have knowledge of user preferences/privilegesthat products that can access Wintec’s NovellDirectory Service (NDS) might utilise.3.5 OUTSOURCED SOLUTIONIt is possible to have all Internet traffic analysedby a third party, who provide the range of ICF services.This considerably reduces the support required toprovide an ICF solution, however, like the NetworkAppliance solution, it does not deal with internalnetwork sources of viruses and cannot be configuredwith individual preferences.4 METHOD4.1 DATA COLLECTIONData has been collected from 1) Commercial andnon-commercial product information and web sites,2) Vendor presentations, informal telephone interviewsof key staff at a number of New Zealand educationalinstitutions, library searches of academic and non-academic materials.The problem of finding the optimum ICF solutionis easily split into sub-problems as outlined in section2 above. Students taking the 3rd year paper‘Introduction to Research Methods’ on the Bachelorof Information Technology Degree at Wintec wereeach asked to choose one of these sub-problems asa topic for their major assignment.  The authors werethen able to extend this work and bring each of thesub-problems back together.Two of the authors are Wintec network engineersand so have a detailed knowledge of the Wintecnetwork and the requirements of a suitable ICFsolution: This knowledge is a critical component ofthe data analysis process described in the nextsection.4.2 DATA ANALYSISThe task of choosing the appropriate ICF solutionis complex due to the large number of potentialcandidates and is essentially a decision supportprocess.  The Analytic Hierarchy Process, AHP, (T.and NBM servers) should have an anti virus productinstalled.  Server platforms include: Novell, Unix andWindows2000.Workstations – These should continue to have virusprotection software to intercept viruses introduced viafloppy disks, CDROMs etc.Currently students use the Pegasus Mail (2003)email application hosted on a NetWare server thatcould be protected by a NetWare anti virus product.However, it is planned to migrate this service to NovellNetMail XE (Novell 2003b) that includes anti virussupport.3.2 NON WORK RELATED HTTPTRAFFICThere are numerous products available for blockingaccess to urls and in particular the latest version ofNBM now includes the N2H2 Internet Filtering solution(N2H2 2003) that uses the SurfControl Contentdatabase.  Implementing this software fully may wellprovide sufficient control of HTTP traffic.Charging traffic back to the end user (or theirdepartment) has been shown as an effective measureof reducing HTTP traffic for at least one other institution[Travaglia, personal communication].  An intermediatestep to charging is to make line managers aware ofthe traffic volume and sites visited by staff.  Chargingstudents for Internet traffic (above a sufficient quotadeemed suitable for completing studies) may also bea suitable option for reducing traffic volume.3.3 SPAMThere are two main strategies for reducing SPAM.1) Refuse email from ‘known’ SPAM sources usingthird party lists, 2) Use software that looks at eachemail and using various rules makes a judgementabout whether it is SPAM or not.  Once this judgementhas been made, the email can either be blocked fromgoing to the users account, or it can be tagged with avalue describing the likely hound of it being SPAM.Users can then set up a rule in their email softwarethat delivers all email over a certain SPAM value totheir SPAM email box.Wintec would prefer to give staff and students somecontrol over what they regard as SPAM as this willhopefully avoid the problems of blocking non SPAM(HAM) email by mistake.  There are also numerousanti SPAM solutions available and the latest versionof Novell GroupWise has introduced limited anti SPAMprotection and so this will be considered as a possiblesolution.286L. Saaty 1980) is a popular method for makingcomplex decisions and was chosen for this study.The AHP has been embedded into the decisionsupport software called ‘Expert Choice’ and the book‘Decision by Objectives’ (Forman 2003) on the ExpertChoice web site gives a good introduction into thedecision making process using AHP and ExpertChoice.  The AHP is a multicriteria decision makingtechnique that allows you to incorporate both objectiveand subjective factors.  For example, suppose adecision was made to purchase a car; the criteria forcomparing are first chosen e.g. price, engine size andinterior design.  Two cars at a time are then comparedon each of the identified criteria and the criteria arealso ranked in order of importance by comparing twocriteria at a time.  The end result is a ranked order ofcars that reflects how individual criteria compare andhow important each criterion is to the decision.  It isthen possible to ‘defend’ the decision and if requiredrevisit the weightings that are placed on each factor.4.2.1 WEIGHTING OF CRITERIAAt the start of the project, broad ICF requirementswere proposed and discussed and this was used toguide the search for suitable software and solutionsand enable ‘intelligent’ questioning of vendors at anumber of vendor presentations.5. RESULTSResults of the data analysis will be presented atthe conference and will also be published in full at alater date.ACKNOWLEDGEMENTSThe authors would like to thank the followingstudents who through their ‘Introduction to ResearchMethods’ course assignments have made valuablecontributions to this paper: David Dutiyabodhi, RichardHaines, Asher Lucus and David Speake.REFERENCESBurke, B., Christiansen, C. and Kolodgy, C. (2002),“Worldwide Secure Content ManagementSoftware Market Forecast and Analysis, 2002-2006: Vendor Views” IDC Bulletin 27299: http://www.idc.comCommand Software Systems (2003), Accessed May2003: http://www.commandsoftware.com/index.cfmCyberPatrol (2003), Accessed May 2003: http://w w w. c y b e r pa t r o l . c o m / h o w _ t o _ b u y /business.aspxFilms, Videos and Publication Classification Act(1993), Accessed May 2003: http://rangi.knowledge-basket.co.nz/gpacts/public/text/1993/se/094se3.htmlForman, E., (2003), “Decision By Objectives (How toconvince others that you are right)”, AccessedApril 2003: http://www.expertchoice.com/dbo/Metz, C (2003), “SPAM is getting worse”, AccessedMay 2003: http://www.pcmag.com/print_article/0,3048,a=41379,00.aspN2H2 (2003), Accessed May 2003: http://www.n2h2.com/index.phpNovell (2003), “Novell BorderManager 3.7”, AccessedApril 2003: http:// http://www.novell.com/products/bordermanager/Novell (2003b), “Novell NetMail XE”, Accessed May2003: http://www.novell.com/products/netmailxe/Pegasus Mail (2003), Accessed May 2003: http://www.pmail.com/Saaty, T.L. (1980), “The Analytic Hierarchy Process”,McGraw-Hill, New York.SurfControl (2003), SurfControl Web Filter for NovellBorderManager” Accessed April 2003: http://www.surfcontrol.com/products/web/novell/

Selection of an internet content filtering solution using the analytic hierarchy process

http://researcharchive.wintec.ac.nz/6803/1/Hunt%202003.pdf

Selection of an internet content filtering solution using the analytic hierarchy process

Abstract

Similar works

Full text

Available Versions

Wintec Research Archive