Distributed autonomous systems that rely on dataset matching and set intersection computation for decision making capabilities are vulnerable to datasets poisoning attacks. Among these systems, Industrial Control Systems (ICS) operating on critical infrastructures. Attacker with a compromised Programmable Logic Controllers (PLCs) can take advantage of the PLC-to-PLC information sharing process to construct and inject anomalous data that target the result of dataset matching and set intersection computation and hence bring the process operations into unstable state. We introduce a protocol that utilizes secure hamming distance computation from oblivious transfer to compute a joint set between two system's agents that hold private input datasets of length n . The proposed protocol achieves full security in the semihonest model.
Distributed Denial of Service(DDoS) attacks are inevitable. The existing defensive mechanisms are relatively outdated. In this paper, we present a passive mechanism to reduce the impact of an attack on the network. We designed and implemented a robust feedback architecture, to maintain the stability of the network despite attacks. During an attack, the controller of the feedback architecture detects the irregularities in the response time and the necessary changes are made to the configuration to maintain the network in steady state. In this approach first, we model the network using black-box system identification technique. Second, we validate the model with test data by conducting various experiments such as varying the network topology. Last, we test the model with the feedback architecture built in our lab environment. Results show that the feedback architecture provides an average model fit accuracy with positive results. 1
In a large enterprise it is difficult for cyber security analysts to know what services and roles every machine on the network is performing (e.g., file server, domain name server, email server). Using network flow data, already collected by most enterprises, we developed a proof-of-concept tool that discovers the roles of a system using both clustering and categorization techniques. The tool's role information would allow cyber analysts to detect consequential changes in the network, initiate incident response plans, and optimize their security posture. The results of this proof-of-concept tool proved to be quite accurate on three real data sets. We will present the algorithms used in the tool, describe the results of preliminary testing, provide visualizations of the results, and discuss areas for future work. Without this kind of situational awareness, cyber analysts cannot quickly diagnose an attack or prioritize remedial actions.
Virtual Routers (VRs) are increasingly common in cloud environments. VRs route traffic between network segments and support network services. Routers, including VRs, have been the target of several recent high-profile attacks, emphasizing the need for more security measures, including security monitoring. However, existing agent-based monitoring systems are incompatible with a VR's temporary nature, stripped-down operating system, and placement in the cloud. As a result, VRs are often not monitored, leading to undetected security incidents. This paper proposes a new security monitoring design that leverages virtualization instead of in-guest agents. Its hypervisor-based system, Arav, scrutinizes VRs by novel application of Virtual Machine Introspection (VMI) breakpoint injection. Arav monitored and addressed security-related events in two common VRs, pfSense and VyOS , and detected four attacks against two popular VR services, Quagga and OpenVPN. Arav's performance overhead is negligible, less than 0.63%, demonstrating VMI's utility in monitoring virtual machines unsuitable for traditional security monitoring.
Cyber attacks occur on a near daily basis and are becoming exponentially more common. While some research aims to detect the characteristics of an attack, little focus has been given to patterns of attacks in general. This paper aims to exploit temporal correlations between the number of attacks per day in order to predict future intensity of cyber incidents. Through analysis of attack data collected from Hackmageddon, correlation was found among reported attack volume in consecutive days. This paper presents a forecasting system that aims to predict the number of cyber attacks on a given day based only on a set of historical attack count data. Our system conducts ARIMA time series forecasting on all previously collected incidents to predict the expected number of attacks on a future date. Our tool is able to use only a subset of data relevant to a specific attack method. Prediction models are dynamically updated over time as new data is collected to improve accuracy. Our system outperforms naive forecasting methods by 14.1% when predicting attacks of any type, and up to 21.2% when forecasting attacks of a specific type. Our system also produces a model which more accurately predicts future cyber attack intensity behavior.
This paper describes a unified framework for the simulation and analysis of cyber physical systems (CPSs). The framework relies on the FreeBSD-based IMUNES network simulator. Components of the CPS are modeled as nodes within the IMUNES network simulator; nodes that communicate using real TCP/IP traffic. Furthermore, the simulated system can be exposed to other networks and the Internet to make it look like a real SCADA system. The frame-work has been used to simulate a TRIGA nuclear reactor. This is accomplished by creating nodes within the IMUNES network capable of running system modules simulating different CPS components. Nodes communicate using MODBUS/TCP, a widely used process control protocol. A goal of this work is to eventually integrate the simulator with a honeynet. This allows researchers to not only simulate a digital control system using real TCP/IP traffic to test control strategies and network topologies, but also to explore possible cyber attacks and mitigation strategies.
Software-Defined Networking (SDN) is an emerging paradigm that introduces a concept of programmable networks to enhance the agility in networking management. By separating concerns of the data plane and the control plane, implementing network switching as packet forwarding, and using centralized software to logically control the entire networks, SDN makes it simpler to automate and configure the network to respond to high-level policy enforcement and dynamically changing network conditions. As SDN becomes more prevalent, its security issues are increasingly critical. Eaves-dropping attacks are one of the most common and important network attacks because they are relatively easy to implement and their effects can escalate to more severe attacks. This paper addresses the issue of how to cope with eavesdropping attacks in the SDN data plane by using multiple routing paths to reduce the severity of data leakage. While this existing approach appears to be considerably effective, our simple analysis uncovers that without a proper strategy of data communication, it can still lead to 100% of data exposure. The paper describes a remedy along with illustrations both analytically and experimentally. The results show that our proposed remedy can avoid such catastrophe and further reduces the percentage of risk from data exposure approximately by a factor of 1/n where n is the number of alternate disjoint paths.
Network analysts have long used two-dimensional security visualizations to make sense of overwhelming amounts of network data. As networks grow larger and more complex, two-dimensional displays can become convoluted, compromising user cyber-threat perspective. Using augmented reality to display data with cyber-physical context creates a naturally intuitive interface that helps restore perspective and comprehension sacrificed by complicated two-dimensional visualizations. We introduce Mobile Augmented Reality for Cybersecurity, or MARCS, as a platform to visualize a diverse array of data in real time and space to improve user perspective and threat response. Early work centers around CovARVT and ConnectAR, two proof of concept, prototype applications designed to visualize intrusion detection and wireless association data, respectively.
In this paper, we propose a version of RSA encryption that uses the Chinese Remainder Theorem (CRT) for the purpose of concealing multiple plain-texts in one cipher-text. This scheme allows the sender to possibly send different information to multiple receivers, and each receiver is only able to decrypt the message intended for them. We prove the algorithm mathematically. Furthermore, we prove our algorithm secure against the chosen plain-text (CPA) attack. We also compare textbook RSA against our algorithm and show the security and size advantages. The new algorithm can also take advantage of current methods that speed up the decryption process of RSA. This scheme will become a basis for further one to many public key cryptosystems.
With the cybersecurity of critical infrastructures becoming increasingly significant, methods for testing the security of cyber-physical systems are still under development. One promising method is hybrid attack graph (HAG) analysis. HAGs extend attack graphs to model the hybrid behavior of cyber-physical systems (CPSs). Generating these graphs is computationally intensive, as the system state space is enormous, yet many states may not be physically realizable. This paper introduces the concept of priorities to hybrid attack graphs, which is designed to reduce state explosion while preserving all relevant attack paths. While designed for hybrid attack graphs, priorities can be applied to traditional attack graphs as well.
The security of computer networks is critical to our nation's civil and military infrastructure. Eliminating vulnerabilities in network software will significantly improve security of our computer and military systems. The Automatic Generation of Network Element Software (AGNES) code generator will generate network element software that is free from known weaknesses which in turn will reduce vulnerabilities. AGNES uses an ontology of coding solutions based on network element standards and the Common Weakness Enumeration (CWE) database to avoid common weaknesses. The generated software will be put through rigorous static analysis to validate the absence of known weaknesses. The generated code will be compared to open source software for comparison of code quality, functionality and performance.
Modern vehicles rely on hundreds of on-board electronic control units (ECUs) communicating over in-vehicle networks. As external interfaces to the car control networks (such as the on-board diagnostic (OBD) port, auxiliary media ports, etc.) become common, and vehicle-to-vehicle / vehicle-to-infrastructure technology is in the near future, the attack surface for vehicles grows, exposing control networks to potentially life-critical attacks. This paper addresses the need for securing the controller area network (CAN) bus by detecting anomalous traffic patterns via unusual refresh rates of certain commands. While previous works have identified signal frequency as an important feature for CAN bus intrusion detection, this paper provides the first such algorithm with experiments using three attacks in five (total) scenarios. Our data-driven anomaly detection algorithm requires only five seconds of training time (on normal data) and achieves true positive / false discovery rates of 0.9998/0.00298, respectively (micro-averaged across the five experimental tests).
With the popularity of various online software marketplaces, third-party vendors are creating many instances of software applications ('apps') for mobile and desktop devices targeting the same set of requirements. This abundance makes the task of selecting and recommending (S&R) apps, with a high degree of assurance, for a specific scenario a significant challenge. The S&R process is a precursor for composing any trusted system made out of such individually selected apps. In addition to feature-based information, about these apps, these marketplaces contain large volumes of user reviews. These reviews contain unstructured user sentiments about app features and the onus of using these reviews in the S&R process is put on the user. This approach is ad-hoc, laborious and typically leads to a superficial incorporation of the reviews in the S&R process by the users. However, due to the large volumes of such reviews and associated computing, these two techniques are not able to provide expected results in real-time or near real-time. Therefore, in this paper, we present two parallel versions (i.e., batch processing and stream processing) of these algorithms and empirically validate their performance using publically available datasets from the Amazon and Android marketplaces. The results of our study show that these parallel versions achieve near real-time performance, when measured as the end-to-end response time, while selecting and recommending apps for specific queries.
This paper describes our initial results achieved using an unsupervised approach for finding suspicious behavior in enterprise networks. We are using sequential pattern mining (SPM) to extract sequences of events for all IPs in a network. The premise of this work is that sequences which describe malicious behavior will be rare. To our knowledge there are no other works that use SPM to identify malicious behavior in Common Event Format (CEF) datasets of the type we are using. Our initial results show promise: when the sequences are built per source IP a cyber analyst would have to look at less than 0.4% of all IPs in order to find all the malicious ones.
The ability to predict cyber incidents before they occur will help mitigate malicious activities and their impact. This is a challenging task and a departure from intrusion detection where observables of malicious activities are analyzed. Since there is no direct observable before the cyber incident actually happens, the predictive analysis need to be based on non-conventional signals that may or may not be directly related to the potential victim entity. This paper presents our preliminary findings through the use of Bayesian classifier to process signals drawn from global events and social media. The preliminary results show promising prediction performance for an anonymized organization even though the signals are not specific to that organization.
Over the past decades, cyber attacks have grown in frequency as well as in sophistication. Often, they elude the counter-measures that are in place due to inadequate expert man-power that is necessary to manually deploy the correct responses and maintain systems being compromised. In this paper, we present a decision support framework with the two specific objectives: to identify the best set of responses given the knowledge of the attack and the system being protected; and to identify the minimal set of responses that must be deployed. While appropriateness of responses is of utmost importance to safeguard systems from attacks, minimality in the number of responses, though an important factor from the deployment perspective, has often been discarded. Our framework leverages National Vulnerability Database as a source for information about the vulnerabilities exploited, relies on the pre-specified expert knowledge about the responses that can adequately stop attack and takes into considerations the impact of an attack as well as responses on the system being protected in terms of CIA vector. We investigate several heuristics for selecting best responses, discuss their relative advantages and disadvantages, and present a specific heuristic, which can produce the optimal result.
Adiabatic logic is one of the promising computing paradigm to design energy-efficient and Differential Power Analysis (DPA)-resistant hardware. However, CMOS based adiabatic logic suffers from high leakage power. In order to reduce the leakage power in the existing DPA-resistant adiabatic logic families, we are investigating the usefulness of Ultra-Thin-Body Silicon-On-Insulator (UTB-SOI) devices as the replacement of CMOS devices. As a case study, we have implemented the PRESENT-80 Light Weight Cryptography (LWC) algorithm in UTB-SOI based Symmetric Pass Gate Adiabatic Logic (SPGAL). The security of UTB-SOI SPGAL based PRESENT-80 has been evaluated by performing a DPA attack through SPICE simulations. We proved that the UTB-SOI SPGAL implementation of the PRESENT-80 algorithm is resistant to DPA attacks. SPICE simulations show that the consumption of leakage power for UTB-SOI SPGAL XOR gate is 60% less in comparison to CMOS SPGAL XOR gate. It is also shown that, one round of PRESENT-80 simulated using UTB-SOI SPGAL consumes 36% less power in comparison to CMOS SPGAL one round of PRESENT-80.
Elliptic curve cryptography (ECC) is a relatively newer form of public key cryptography that provides more security per bit than other forms of cryptography still being used today. We explore the mathematical structure and operations of elliptic curves and how those properties make curves suitable tools for cryptography. A brief historical context is given followed by the safety of usage in production, as not all curves are free from vulnerabilities. Next, we compare ECC with other popular forms of cryptography for both key exchange and digital signatures, in terms of security and speed. Traditional applications of ECC, both theoretical and in-practice, are presented, including key exchange for web browser usage and DNSSEC. We examine multiple uses of ECC in a mobile context, including cellular phones and the Internet of Things. Modern applications of curves are explored, such as iris recognition, RFID, smart grid, as well as an application for E-health. Finally, we discuss how ECC stacks up in a post-quantum cryptography world.
Game theory is appropriate for studying cyber conflict because it allows for an intelligent and goal-driven adversary. Applications of game theory have led to a number of results regarding optimal attack and defense strategies. However, the overwhelming majority of applications explore overly simplistic games, often ones in which each participant's actions are visible to every other participant. These simplifications strip away the fundamental properties of real cyber conflicts: probabilistic alerting, hidden actions, unknown opponent capabilities. In this paper, we demonstrate that it is possible to analyze a more realistic game, one in which different resources have different weaknesses, players have different exploits, and moves occur in secrecy, but they can be detected. Certainly, more advanced and complex games are possible, but the game presented here is more realistic than any other game we know of in the scientific literature. While optimal strategies can be found for simpler games using calculus, case-by-case analysis, or, for stochastic games, Q-learning, our more complex game is more naturally analyzed using the same methods used to study other complex games, such as checkers and chess. We define a simple evaluation function and ploy multi-step searches to create strategies. We show that such scenarios can be analyzed, and find that in cases of extreme uncertainty, it is often better to ignore one's opponent's possible moves. Furthermore, we show that a simple evaluation function in a complex game can lead to interesting and nuanced strategies.
Cyber security research has produced numerous artificial diversity techniques such as address space layout randomization, heap randomization, instruction-set randomization, and instruction location randomization. To be most effective, these techniques must be high entropy and secure from information leakage which, in practice, is often difficult to achieve. Indeed, it has been demonstrated that well-funded, determined adversaries can often circumvent these defenses. To allow use of low-entropy diversity, prevent information leakage, and provide provable security against attacks, previous research proposed using low-entropy but carefully structured artificial diversity to create variants of an application and then run these constructed variants within a fault-tolerant environment that runs each variant in parallel and cross check results to detect and mitigate faults. If the variants are carefully constructed, it is possible to prove that certain classes of attack are not possible. This paper presents an overview and status of a cyber fault tolerant system that uses a low overhead multi-variant execution environment and precise static binary analysis and efficient rewriting technology to produce structured variants which allow automated verification techniques to prove security properties of the system. Preliminary results are presented which demonstrate that the system is capable of detecting unknown faults and mitigating attacks.
