01984nas a2200229   4500008004100000022001400041245005600055210005400111260004200165300001000207490000600217520133000223653002601553653001801579653002501597653002201622653002001644653001701664100002201681700001501703856003601718       2013                        eng d  a1927-032100aPeer-to-Peer Enclaves for Improving Network Defence0 aPeertoPeer Enclaves for Improving Network Defence  aOttawabTalent First Networkc07/2013  a19-240 v33 aInformation about cyberthreats within networks spreads slowly relative to the speed at which those threats spread. Typical "threat feeds" that are commercially available also disseminate information slowly relative to the propagation speed of attacks, and they often convey irrelevant information about imminent threats. As a result, hosts sharing a network may miss opportunities to improve their defence postures against imminent attack because needed information arrives too late or is lost in irrelevant noise. We envision timely, relevant peer-to-peer sharing of threat information – based on current technologies – as a solution to these problems and as a useful design pattern for defensive cyberwarfare. In our setting, network nodes form communities that we call enclaves, where each node defends itself while sharing information on imminent threats with peers that have similar threat exposure. In this article, we present our vision for this solution. We sketch the architecture of a typical node in such a network and how it might interact with a framework for sharing threat information; we explain why certain defensive countermeasures may work better in our setting; we discuss current tools that could be used as components in our vision; and we describe opportunities for future research and development.10acyber countermeasures10acybersecurity10adynamic cyberdefence10aenclave computing10anetwork defence10apeer-to-peer1 aArcher, David, W.1 aWick, Adam  uhttp://timreview.ca/article/701