Search

In this paper, we describe the design and creation of four publicly available datasets generated using a testbed with simulated benign users and a manual attacker. The datasets were created to provide examples of cyber exploitations and aid in the production of reproducible research that address cyber security challenges. The CyberVAN testbed provides sophisticated capabilities for high-fidelity cyber experimentation in strategic and tactical network environments. The representative network is sufficiently complex with synthetic users performing normal duties that generate traffic (webpage browsing, e-mail, etc.). Both network and host based facts/logs are included in the dataset along with a diagram of the network and a timeline of events. The four datasets encompass progressively complex scenarios: 1) malware infection injection via a phishing email attachment; 2) propagating botnet injection via phishing email attachment with a Single Fast Flux algorithm for bot master identification/communication; 3) propagating botnet injection via email link using a Domain Generation Algorithm for bot master identification/communication; 4) propagating botnet injection via corruption of a legitimate internal web server with Double Fast Flux for bot master identification/communication. The full datasets along with relevant documentation is available for public download. Additional datasets containing tactical network scenarios and environments will be added to the repository in the future with the goal of enabling reproducible cyber security research that will advance the science of cyber security.

Network management represents one of the most challenging activities in tactical mobile ad hoc networks due to the need for rapid planning and configuration to support a given mission, in the face of large variability in wireless network performance and unpredictable conditions. Traditionally, independent tools, such as network planning and configuration, fault and performance management, and middleware have been designed to provide comprehensive network management capabilities. However, the lack of any integration between these tools often results in sub-optimal or conflicting network actions, conducting to inadequate network performance. More importantly, state of the art network management tools do not incorporate the mission intent into autonomous network management activities. This paper describes the TITAN (Tactical Information Technologies for Assured Networks) NM (Network Manager), an integrated network management tool that orchestrates and coordinates its actions such that network planning, configuration, fault response and performance adaptation take place seamlessly and coherently, on the basis of the mission intent. This ensures optimized network operations that achieve the intent of the mission. We present performance evaluation results for the TITAN NM in field experiments performed during C4ISR 2011 On-The-Move exercises at Fort Dix, NJ.

Virtual Ad Hoc Network (VAN) testbed aims at achieving large scale application testing for ad hoc networks by integrating host virtualization and network simulation. Efficient use of storage space is essential for such testbeds. Storage redundancy resulting from duplicated files and application installations across the virtual machines in a large scale testbed (> a few hundred VMs) can be significantly reduced by using storage sharing techniques. Although Content Addressable Storage (CAS) along with Copy-on-write can remove storage redundancy at block-level, it requires hash computation for every write operation that incurs considerable online computation overhead.To address the unique problems where the virtual machines on the testbed would have identical or very similar file system structure, we propose File-level Block Sharing (FBS) that identifies redundant blocks by only comparing the blocks belonging to the files with same or similar filenames across virtual machines. FBS is applicable to both SAN storage systems and cluster file systems. Our proof-of-concept prototype on iSCSI and Linux LVM showed only 1.78% lost in throughput.

This paper describes an approach to root cause analysis and fault correlation that addresses the problems inherent in wireless military networks.1 Root cause analysis concerns itself with identifying and correcting problems in a network. The ultimate goal of root cause analysis is to diagnose the cause for network anomalies, towards the ultimate goal of ensuring that adequate communication functionality is maintained to support the requirements of the network users. In a wired network, the diagnosis of faults is easier due to the existence of a fixed, wired topology and fixed, wired links. In the wireless networks at the tactical edge of military networks, there is no hardwired connectivity, yet there are also expectations on the network from the end users which place constraints on the operation of the network. Fault diagnosis in such networks is fundamentally different from that in wired networks. The performance of the network must be managed explicitly with respect to its user expectations, even though the network connectivity is dynamic, the network monitoring traffic must traverse the (possibly failing) network itself, and the “correct” behavior of the network against which current network state needs to be compared evolves over time. The novel features of our solution that distinguish it from existing root cause analysis techniques are (a) a dynamic model of fault, performance and security problem propagation in the network that can evolve as the definition of network correctness changes, (b) a method for distributing reasoning over this model throughout the network into independent Correlators that share information through a set of Clearinghouses to provide a global root cause correlation capability, and (c) the ability for the Correlator and Clearinghouse reasoning to adapt gracefully when network problems prevent full exchange of information required for root cause analysis.

Layer 2 radio resource allocation schemes being used in mobile ad hoc networks (MANET) do not always take into account the quality of service (QoS) requirements of network traffic. As an example, the current USAP (unifying slot assignment protocol) slot allocation scheme is QoS-unaware. Consequently the scheme could grant available slots to lower priority traffic instead of higher priority traffic. This greatly reduces the effectiveness of QoS management schemes at other layers of the protocol stack (e.g. DiffServ at layer 3, and admission control at the application layer). We describe a cross-layer solution to this problem where a local QoS control (LQC) component is placed on every node. The LQCs on nodes in a channelized neighborhood share their per traffic class radio resource needs, enabling the LQC at each node to determine its urgency for additional slots comparing to that of other nodes in the neighborhood. Thus, in nodes that have a less urgent need for slots, the LQC can filter local application traffic to reduce the local demand for slots, which in turn helps those nodes with more urgent need to have a better chance securing additional slots. A description of the approach and a performance analysis is presented.

DRAMA1 is a distributed policy-based management system designed to manage Mobile Ad hoc NETworks (MANETs). Its design philosophy is to create intelligent, self-adaptive policy agents to manage dynamic networks without human intervention. Network management functions are performed in a distributed fashion by these policy agents, rather than being controlled by a centralized management station. Policies are used to control the frequency and content of network management messages exchanged among policy agents in a way that reduces bandwidth usage and increases the utility of management messages. This greatly enhances management efficiency and reduces the bandwidth overhead required for network management. As with any new technology, there is a question about the scalability of this approach. The purpose of the work described in this paper is to study whether the DRAMA policy-based network management system can scale to networks of 500+ nodes. The study uses a novel simulation-based approach to evaluate DRAMA performance when DRAMA is used to manage MANETs of up to 500 nodes. The results confirm that the DRAMA distributed policy-based management paradigm provides superior performance over a centralized management paradigm for MANETs.

The characteristics of ad hoc networks greatly increase the complexity of programming distributed applications with respect to both sending and receiving messages. This is because the network programming API based upon TCP and UDP was designed for the relatively stable, stationary Internet. The semantics of the API does not address the emerging issues from the dynamic mobile wireless ad hoc networks. One promising approach for alleviating this problem is to develop applications on top of a middleware system to shield applications from dealing with the dynamics of ad hoc networks. However, conventional middleware systems were not designed to cope with the frequently changing communications characteristics of military ad hoc networks. In order to address the above problem, we have designed and implemented a prototype of AMS , an Adaptive Middleware System with the following features. First, this middleware system is specifically designed to deal with dynamic and unreliable networks. Second, it shields communicating entities from coping with frequently changing networks via an API with semantics that provide a suitable abstraction of the underlying dynamic networks. Third, it allows individual applications to define their own communications requirements while the middleware system can set the lowest common requirements for all the communications per the military situations. Lastly, this middleware system has an interface that allows an external control system to adjust the values of its parameters to optimize the overall system performance.

YAP is a protocol designed to efficiently and robustly relay network configuration states of nodes to a designated node that collects and stores the configuration states of all the nodes. Once the configuration states from the nodes are collected, any application can query the information to perform its own specific function. For example, a GUI application can query the database to display the logical topology of the networks. Also a Configuration Manager can query the database to decide how to reconfigure the network. We describe how YAP was integrated with protocols designed to auto-configure IP-related attributes of nodes (using DRCP and DCDP).

We describe in this paper a novel design of a network management architecture that incorporates both agent and policy technologies. The conceptual model, main components, and various transports employed in this architecture are discussed. We believe that this network management architecture is highly scalable and capable of adapting network protocols and services on-the-fly with the goal of optimizing the efficiency of operations.

Testing of applications for ad hoc networks poses a special technical challenge due to the difficulty of conducting experiments in an ad hoc network environment at a scale larger than a few nodes. One approach is to conduct experiments in a testbed that can imitate an ad hoc network. This requires the development of technologies that enable multiple instances of unmodified application software on a set of hosts to communicate via a simulated network that behaves like a real ad hoc network. In this paper, we describe the testbed developed under the virtual ad hoc network (VAN) testbed project for testing applications over ad hoc networks, with a special focus on network management applications. The testbed employs Xen-based virtualisation to achieve resource scalability. The infrastructure for the testbed provides an integrated platform consisting of virtual nodes running the actual software under test, augmented with a simulated network environment. Our goal is to enable software testing over large-scale (500-1000 nodes) ad hoc networks using the VAN testbed.