Search

Cyber deception has emerged as a promising approach to increase the amount of effort required to conduct an attack campaign. Since the beginning of deception, several honey-based technologies have been built to defend individual portions of a network attack surface. Different honey-based technologies can be combined to further increase attackers’ cost and elicit behaviors from them which facilitate understanding their intentions and capabilities. Combining different deceptive elements would create a deceptive network surface. As attackers vary in their intentions and capabilities, presenting them with a one-size-fits-all deceptive network surface is inadequate. Therefore, there is clear need for dynamic deceptive network surfaces that are tailored to protect against different adversary classes. In a resource-constrained environment, enabling large-scale monitoring, data processing, deception planning and subsequently, deploying a customized deceptive network surface in real-time will be challenging if done manually. We envision that models inspired from the autonomic computing paradigm can efficiently tackle such challenges. To enable the development of such models and provide empirical evidence to validate their efficacy, in this chapter, we will present a framework that can act as a common platform to study different autonomic computing models. The framework is built on top of an existing deception platform called ACyDS. We will describe the current platform and enumerate its capabilities such as sensing the environment and generating deceptive network surfaces. We will also show how a well-known autonomic computing architecture called MAPE-K can be realized through our framework.

In this paper, we describe the design and creation of four publicly available datasets generated using a testbed with simulated benign users and a manual attacker. The datasets were created to provide examples of cyber exploitations and aid in the production of reproducible research that address cyber security challenges. The CyberVAN testbed provides sophisticated capabilities for high-fidelity cyber experimentation in strategic and tactical network environments. The representative network is sufficiently complex with synthetic users performing normal duties that generate traffic (webpage browsing, e-mail, etc.). Both network and host based facts/logs are included in the dataset along with a diagram of the network and a timeline of events. The four datasets encompass progressively complex scenarios: 1) malware infection injection via a phishing email attachment; 2) propagating botnet injection via phishing email attachment with a Single Fast Flux algorithm for bot master identification/communication; 3) propagating botnet injection via email link using a Domain Generation Algorithm for bot master identification/communication; 4) propagating botnet injection via corruption of a legitimate internal web server with Double Fast Flux for bot master identification/communication. The full datasets along with relevant documentation is available for public download. Additional datasets containing tactical network scenarios and environments will be added to the repository in the future with the goal of enabling reproducible cyber security research that will advance the science of cyber security.

With the virtual machine technologies, Virtual Ad hoc Network (VAN) testbed was designed to evaluate functional correctness and communication performance of Mobile Ad hoc Network (MANET) applications. When VAN is used for large-scale testing that requires hundreds of virtual machines, storage redundancy becomes an issue. Although Content Addressable Storage (CAS) techniques were designed to address the storage redundancy issue, it incurred online hash computation overhead for every write access to disk blocks, which affects testing accuracy. We present File-level Block Sharing (FBS) that achieves the same functionality of CAS while removing the online computation overhead. By getting file-to-block mappings through read-only mounting, FBS only needs to handle the blocks belonging to newly-installed files offline and thus incurs little online overhead. Our prototype showed no online overhead statistically and low offline overhead. The prototype was developed and its overhead with respect to block-level storage deduplication was analyzed under both Ext2/3/4 and NTFS file systems.

Virtual Ad Hoc Network (VAN) testbed aims at achieving large scale application testing for ad hoc networks by integrating host virtualization and network simulation. Efficient use of storage space is essential for such testbeds. Storage redundancy resulting from duplicated files and application installations across the virtual machines in a large scale testbed (> a few hundred VMs) can be significantly reduced by using storage sharing techniques. Although Content Addressable Storage (CAS) along with Copy-on-write can remove storage redundancy at block-level, it requires hash computation for every write operation that incurs considerable online computation overhead.To address the unique problems where the virtual machines on the testbed would have identical or very similar file system structure, we propose File-level Block Sharing (FBS) that identifies redundant blocks by only comparing the blocks belonging to the files with same or similar filenames across virtual machines. FBS is applicable to both SAN storage systems and cluster file systems. Our proof-of-concept prototype on iSCSI and Linux LVM showed only 1.78% lost in throughput.

Military Network Operations (NetOps) consist of three main components: network management, network defense (information assurance), and content staging (information dissemination management). NetOps capabilities include organizations, procedures, and technologies required to manage, defend, and utilize a network. Conventionally NetOps components are regarded as functionally orthogonal and operationally independent. However, based on our experience1 with the future Army tactical network that consist of mobile ad hoc networks (MANETs), we believe these components should be integrated to enhance NetOps in MANET environments. We envision that with the creation of an over-arching architectural framework to underlie NetOps components, future Army tactical network operations will provide better support to network centric warfare. Also, the focus of NetOps should transition from maintaining network operations to providing optimal communications. In this paper, we describe issues and challenges associated with integrating NetOps components for future Army tactical networks, and discuss path forward.

The characteristics of ad hoc networks greatly increase the complexity of programming distributed applications with respect to both sending and receiving messages. This is because the network programming API based upon TCP and UDP was designed for the relatively stable, stationary Internet. The semantics of the API does not address the emerging issues from the dynamic mobile wireless ad hoc networks. One promising approach for alleviating this problem is to develop applications on top of a middleware system to shield applications from dealing with the dynamics of ad hoc networks. However, conventional middleware systems were not designed to cope with the frequently changing communications characteristics of military ad hoc networks. In order to address the above problem, we have designed and implemented a prototype of AMS , an Adaptive Middleware System with the following features. First, this middleware system is specifically designed to deal with dynamic and unreliable networks. Second, it shields communicating entities from coping with frequently changing networks via an API with semantics that provide a suitable abstraction of the underlying dynamic networks. Third, it allows individual applications to define their own communications requirements while the middleware system can set the lowest common requirements for all the communications per the military situations. Lastly, this middleware system has an interface that allows an external control system to adjust the values of its parameters to optimize the overall system performance.

The popularity of instant messaging highlights the power that the addition of presence information can bring to communications. Instant messaging systems combine multi-party communications with active presence notifications, allowing users to monitor the presence status of others. We describe several ways presence information can enhance next generation telephone communications and how integration can actually improve instant messaging as well. In addition, we will describe some of the issues associated with implementing and deploying such services, including privacy, data ambiguity and inter-system compatibility.