Search

Cyber deception has emerged as a promising approach to increase the amount of effort required to conduct an attack campaign. Since the beginning of deception, several honey-based technologies have been built to defend individual portions of a network attack surface. Different honey-based technologies can be combined to further increase attackers’ cost and elicit behaviors from them which facilitate understanding their intentions and capabilities. Combining different deceptive elements would create a deceptive network surface. As attackers vary in their intentions and capabilities, presenting them with a one-size-fits-all deceptive network surface is inadequate. Therefore, there is clear need for dynamic deceptive network surfaces that are tailored to protect against different adversary classes. In a resource-constrained environment, enabling large-scale monitoring, data processing, deception planning and subsequently, deploying a customized deceptive network surface in real-time will be challenging if done manually. We envision that models inspired from the autonomic computing paradigm can efficiently tackle such challenges. To enable the development of such models and provide empirical evidence to validate their efficacy, in this chapter, we will present a framework that can act as a common platform to study different autonomic computing models. The framework is built on top of an existing deception platform called ACyDS. We will describe the current platform and enumerate its capabilities such as sensing the environment and generating deceptive network surfaces. We will also show how a well-known autonomic computing architecture called MAPE-K can be realized through our framework.

Several recent papers have discussed utilizing Lipschitz constants to limit the susceptibility of neural networks to adversarial examples. We analyze recently proposed methods for computing the Lipschitz constant. We show that the Lipschitz constant may indeed enable adversarially robust neural networks. However, the methods currently employed for computing it suffer from theoretical and practical limitations. We argue that addressing this shortcoming is a promising direction for future research into certified adversarial defenses.

Building robust deep neural network (DNN) machine learning models in adversarial settings is a problem of great importance to communication and cyber security. We consider white-box attacks in which an adversary has full knowledge of the learning architecture, but the adversary's ability to manipulate is bounded in the Lp norm sense. Given that adversarial examples are generated via small perturbations to the input, we develop a scalable mathematical framework that leads to bounds on the effect of these input perturbations on the network output. We study several typical DNN components: linear transformations, ReLU, sigmoid and double ReLU units. We use the well-calibrated MNIST data for experimental validation, and present results and insights.

In this paper, we describe the design and creation of four publicly available datasets generated using a testbed with simulated benign users and a manual attacker. The datasets were created to provide examples of cyber exploitations and aid in the production of reproducible research that address cyber security challenges. The CyberVAN testbed provides sophisticated capabilities for high-fidelity cyber experimentation in strategic and tactical network environments. The representative network is sufficiently complex with synthetic users performing normal duties that generate traffic (webpage browsing, e-mail, etc.). Both network and host based facts/logs are included in the dataset along with a diagram of the network and a timeline of events. The four datasets encompass progressively complex scenarios: 1) malware infection injection via a phishing email attachment; 2) propagating botnet injection via phishing email attachment with a Single Fast Flux algorithm for bot master identification/communication; 3) propagating botnet injection via email link using a Domain Generation Algorithm for bot master identification/communication; 4) propagating botnet injection via corruption of a legitimate internal web server with Double Fast Flux for bot master identification/communication. The full datasets along with relevant documentation is available for public download. Additional datasets containing tactical network scenarios and environments will be added to the repository in the future with the goal of enabling reproducible cyber security research that will advance the science of cyber security.

We discuss in this paper the emerging need for an operation support system to support fast, reconfigurable, time-shared testbeds. We articulate the needs for building an operation support system for such testbeds in order to provide better utilization of testbed resources, enable testers to closely examine and analyze tests, streamline the process of test setup and execution, as well as enhance the efficacy of tests and the throughput of the testbed. In addition, the progress that we have made so far, our current research and development road map, along with foreseeable research challenges are also discussed.

With the virtual machine technologies, Virtual Ad hoc Network (VAN) testbed was designed to evaluate functional correctness and communication performance of Mobile Ad hoc Network (MANET) applications. When VAN is used for large-scale testing that requires hundreds of virtual machines, storage redundancy becomes an issue. Although Content Addressable Storage (CAS) techniques were designed to address the storage redundancy issue, it incurred online hash computation overhead for every write access to disk blocks, which affects testing accuracy. We present File-level Block Sharing (FBS) that achieves the same functionality of CAS while removing the online computation overhead. By getting file-to-block mappings through read-only mounting, FBS only needs to handle the blocks belonging to newly-installed files offline and thus incurs little online overhead. Our prototype showed no online overhead statistically and low offline overhead. The prototype was developed and its overhead with respect to block-level storage deduplication was analyzed under both Ext2/3/4 and NTFS file systems.

Virtual Ad Hoc Network (VAN) testbed aims at achieving large scale application testing for ad hoc networks by integrating host virtualization and network simulation. Efficient use of storage space is essential for such testbeds. Storage redundancy resulting from duplicated files and application installations across the virtual machines in a large scale testbed (> a few hundred VMs) can be significantly reduced by using storage sharing techniques. Although Content Addressable Storage (CAS) along with Copy-on-write can remove storage redundancy at block-level, it requires hash computation for every write operation that incurs considerable online computation overhead.To address the unique problems where the virtual machines on the testbed would have identical or very similar file system structure, we propose File-level Block Sharing (FBS) that identifies redundant blocks by only comparing the blocks belonging to the files with same or similar filenames across virtual machines. FBS is applicable to both SAN storage systems and cluster file systems. Our proof-of-concept prototype on iSCSI and Linux LVM showed only 1.78% lost in throughput.

Deadlock detection scheduling is an important, yet often overlooked problem that can significantly affect the overall performance of deadlock handling. Excessive initiation of deadlock detection increases overall message usage, resulting in degraded system performance in the absence of deadlocks; while insufficient initiation of deadlock detection increases the deadlock persistence time, resulting in an increased deadlock resolution cost in the presence of deadlocks. The investigation of this performance tradeoff, however, is missing in the literature. This paper studies the impact of deadlock detection scheduling on the overall performance of deadlock handling. In particular, we show that there exists an optimal deadlock detection frequency that yields the minimum long-run mean average cost, which is determined by the message complexities of the deadlock detection and resolution algorithms being used, as well as the rate of deadlock formation, denoted as $\lambda$. For the best known deadlock detection and resolution algorithms, we show that the asymptotically optimal frequency of deadlock detection scheduling that minimizes the overall message overhead is ${\cal O}((\lambda n)^{1/3})$, when the total number $n$ of processes is sufficiently large. Furthermore, we show that in general fully distributed (uncoordinated) deadlock detection scheduling cannot be performed as efficiently as centralized (coordinated) deadlock detection scheduling.

Layer 2 radio resource allocation schemes being used in mobile ad hoc networks (MANET) do not always take into account the quality of service (QoS) requirements of network traffic. As an example, the current USAP (unifying slot assignment protocol) slot allocation scheme is QoS-unaware. Consequently the scheme could grant available slots to lower priority traffic instead of higher priority traffic. This greatly reduces the effectiveness of QoS management schemes at other layers of the protocol stack (e.g. DiffServ at layer 3, and admission control at the application layer). We describe a cross-layer solution to this problem where a local QoS control (LQC) component is placed on every node. The LQCs on nodes in a channelized neighborhood share their per traffic class radio resource needs, enabling the LQC at each node to determine its urgency for additional slots comparing to that of other nodes in the neighborhood. Thus, in nodes that have a less urgent need for slots, the LQC can filter local application traffic to reduce the local demand for slots, which in turn helps those nodes with more urgent need to have a better chance securing additional slots. A description of the approach and a performance analysis is presented.

The characteristics of ad hoc networks greatly increase the complexity of programming distributed applications with respect to both sending and receiving messages. This is because the network programming API based upon TCP and UDP was designed for the relatively stable, stationary Internet. The semantics of the API does not address the emerging issues from the dynamic mobile wireless ad hoc networks. One promising approach for alleviating this problem is to develop applications on top of a middleware system to shield applications from dealing with the dynamics of ad hoc networks. However, conventional middleware systems were not designed to cope with the frequently changing communications characteristics of military ad hoc networks. In order to address the above problem, we have designed and implemented a prototype of AMS , an Adaptive Middleware System with the following features. First, this middleware system is specifically designed to deal with dynamic and unreliable networks. Second, it shields communicating entities from coping with frequently changing networks via an API with semantics that provide a suitable abstraction of the underlying dynamic networks. Third, it allows individual applications to define their own communications requirements while the middleware system can set the lowest common requirements for all the communications per the military situations. Lastly, this middleware system has an interface that allows an external control system to adjust the values of its parameters to optimize the overall system performance.

YAP is a protocol designed to efficiently and robustly relay network configuration states of nodes to a designated node that collects and stores the configuration states of all the nodes. Once the configuration states from the nodes are collected, any application can query the information to perform its own specific function. For example, a GUI application can query the database to display the logical topology of the networks. Also a Configuration Manager can query the database to decide how to reconfigure the network. We describe how YAP was integrated with protocols designed to auto-configure IP-related attributes of nodes (using DRCP and DCDP).

The popularity of instant messaging highlights the power that the addition of presence information can bring to communications. Instant messaging systems combine multi-party communications with active presence notifications, allowing users to monitor the presence status of others. We describe several ways presence information can enhance next generation telephone communications and how integration can actually improve instant messaging as well. In addition, we will describe some of the issues associated with implementing and deploying such services, including privacy, data ambiguity and inter-system compatibility.

Testing of applications for ad hoc networks poses a special technical challenge due to the difficulty of conducting experiments in an ad hoc network environment at a scale larger than a few nodes. One approach is to conduct experiments in a testbed that can imitate an ad hoc network. This requires the development of technologies that enable multiple instances of unmodified application software on a set of hosts to communicate via a simulated network that behaves like a real ad hoc network. In this paper, we describe the testbed developed under the virtual ad hoc network (VAN) testbed project for testing applications over ad hoc networks, with a special focus on network management applications. The testbed employs Xen-based virtualisation to achieve resource scalability. The infrastructure for the testbed provides an integrated platform consisting of virtual nodes running the actual software under test, augmented with a simulated network environment. Our goal is to enable software testing over large-scale (500-1000 nodes) ad hoc networks using the VAN testbed.