Search

Cyber deception has emerged as a promising approach to increase the amount of effort required to conduct an attack campaign. Since the beginning of deception, several honey-based technologies have been built to defend individual portions of a network attack surface. Different honey-based technologies can be combined to further increase attackers’ cost and elicit behaviors from them which facilitate understanding their intentions and capabilities. Combining different deceptive elements would create a deceptive network surface. As attackers vary in their intentions and capabilities, presenting them with a one-size-fits-all deceptive network surface is inadequate. Therefore, there is clear need for dynamic deceptive network surfaces that are tailored to protect against different adversary classes. In a resource-constrained environment, enabling large-scale monitoring, data processing, deception planning and subsequently, deploying a customized deceptive network surface in real-time will be challenging if done manually. We envision that models inspired from the autonomic computing paradigm can efficiently tackle such challenges. To enable the development of such models and provide empirical evidence to validate their efficacy, in this chapter, we will present a framework that can act as a common platform to study different autonomic computing models. The framework is built on top of an existing deception platform called ACyDS. We will describe the current platform and enumerate its capabilities such as sensing the environment and generating deceptive network surfaces. We will also show how a well-known autonomic computing architecture called MAPE-K can be realized through our framework.

Several recent papers have discussed utilizing Lipschitz constants to limit the susceptibility of neural networks to adversarial examples. We analyze recently proposed methods for computing the Lipschitz constant. We show that the Lipschitz constant may indeed enable adversarially robust neural networks. However, the methods currently employed for computing it suffer from theoretical and practical limitations. We argue that addressing this shortcoming is a promising direction for future research into certified adversarial defenses.

Building robust deep neural network (DNN) machine learning models in adversarial settings is a problem of great importance to communication and cyber security. We consider white-box attacks in which an adversary has full knowledge of the learning architecture, but the adversary's ability to manipulate is bounded in the Lp norm sense. Given that adversarial examples are generated via small perturbations to the input, we develop a scalable mathematical framework that leads to bounds on the effect of these input perturbations on the network output. We study several typical DNN components: linear transformations, ReLU, sigmoid and double ReLU units. We use the well-calibrated MNIST data for experimental validation, and present results and insights.

In this paper, we describe the design and creation of four publicly available datasets generated using a testbed with simulated benign users and a manual attacker. The datasets were created to provide examples of cyber exploitations and aid in the production of reproducible research that address cyber security challenges. The CyberVAN testbed provides sophisticated capabilities for high-fidelity cyber experimentation in strategic and tactical network environments. The representative network is sufficiently complex with synthetic users performing normal duties that generate traffic (webpage browsing, e-mail, etc.). Both network and host based facts/logs are included in the dataset along with a diagram of the network and a timeline of events. The four datasets encompass progressively complex scenarios: 1) malware infection injection via a phishing email attachment; 2) propagating botnet injection via phishing email attachment with a Single Fast Flux algorithm for bot master identification/communication; 3) propagating botnet injection via email link using a Domain Generation Algorithm for bot master identification/communication; 4) propagating botnet injection via corruption of a legitimate internal web server with Double Fast Flux for bot master identification/communication. The full datasets along with relevant documentation is available for public download. Additional datasets containing tactical network scenarios and environments will be added to the repository in the future with the goal of enabling reproducible cyber security research that will advance the science of cyber security.

Network management represents one of the most challenging activities in tactical mobile ad hoc networks due to the need for rapid planning and configuration to support a given mission, in the face of large variability in wireless network performance and unpredictable conditions. Traditionally, independent tools, such as network planning and configuration, fault and performance management, and middleware have been designed to provide comprehensive network management capabilities. However, the lack of any integration between these tools often results in sub-optimal or conflicting network actions, conducting to inadequate network performance. More importantly, state of the art network management tools do not incorporate the mission intent into autonomous network management activities. This paper describes the TITAN (Tactical Information Technologies for Assured Networks) NM (Network Manager), an integrated network management tool that orchestrates and coordinates its actions such that network planning, configuration, fault response and performance adaptation take place seamlessly and coherently, on the basis of the mission intent. This ensures optimized network operations that achieve the intent of the mission. We present performance evaluation results for the TITAN NM in field experiments performed during C4ISR 2011 On-The-Move exercises at Fort Dix, NJ.

We discuss in this paper the emerging need for an operation support system to support fast, reconfigurable, time-shared testbeds. We articulate the needs for building an operation support system for such testbeds in order to provide better utilization of testbed resources, enable testers to closely examine and analyze tests, streamline the process of test setup and execution, as well as enhance the efficacy of tests and the throughput of the testbed. In addition, the progress that we have made so far, our current research and development road map, along with foreseeable research challenges are also discussed.

Software Defined Radios advanced in the recent years to become the platform of choice for new military and emergency response applications, enabling such functionality as single hardware-multiple waveforms, agile spectrum reuse, and cross layer reconfiguration and optimization. Yet, the choice of platforms available for experimenting new adaptation strategies and re-configuration capabilities is severely limited due to proprietary and canned implementations and architectures. GNU Radio represents an open source radio platform operating on a general purpose processor (GPP,) capable of offering an unprecedented level of re-configurability using common and accessible programming languages and paradigms. As such, it represents an attractive and cost effective platform for experimenting with reconfigurable radio technologies. Yet, GNU Radio had been used so far mainly for experimenting with physical layer algorithms, making it less suitable for data packet radio and networking applications. This paper describes our effort to augment the GNU radio to transform it into a practical platform for communication in tactical ad-hoc networks, while maintaining its dynamic re-configurability capabilities. The results of this effort enabled us to create a deployable network capable of supporting the development and testing of TITAN NM, an integrated network management system with autonomous re-configuration capabilities, and its successful evaluation in C4ISR OTM 2012.

With the virtual machine technologies, Virtual Ad hoc Network (VAN) testbed was designed to evaluate functional correctness and communication performance of Mobile Ad hoc Network (MANET) applications. When VAN is used for large-scale testing that requires hundreds of virtual machines, storage redundancy becomes an issue. Although Content Addressable Storage (CAS) techniques were designed to address the storage redundancy issue, it incurred online hash computation overhead for every write access to disk blocks, which affects testing accuracy. We present File-level Block Sharing (FBS) that achieves the same functionality of CAS while removing the online computation overhead. By getting file-to-block mappings through read-only mounting, FBS only needs to handle the blocks belonging to newly-installed files offline and thus incurs little online overhead. Our prototype showed no online overhead statistically and low offline overhead. The prototype was developed and its overhead with respect to block-level storage deduplication was analyzed under both Ext2/3/4 and NTFS file systems.

In the tactical military context, the network exists to support a mission. Consequently, part of the process of mission planning is to define the required network performance in terms of measurable quantities (metrics). These metrics, such as required message delivery rates, maximum acceptable latencies, and acceptable-loss thresholds are used to design the network. This paper presents the TITAN (Tactical Information Technologies for Assured Networks) Network Management System (NMS), which uses these metrics to manage the network as well. The TITAN NMS generates maintenance policies from the stated mission goals and the generated network plan. The maintenance policies describe the metrics to be measured, the acceptable values of those metrics and the actions to take on various levels of the management hierarchy when values of the metrics are not acceptable. If the policy-defined actions do not restore the network performance to acceptable levels, the TITAN NMS dynamically replans the network to meet the mission needs. We describe the TITAN NMS system and its application to the problem of automating the management of future military tactical networks, along with scenarios illustrating the operation of the system.

Testing of applications for tactical MANETs poses a special technical challenge due to the difficulty of conducting experiments in an ad hoc network environment at a scale larger than a few nodes. One approach is to conduct experiments in Virtual Ad hoc Network (VAN) testbeds1 that can imitate a tactical MANET to a high level of fidelity. For applications, this is achieved by executing unmodified software in their native operating systems on the machines over an emulated platform that uses identical logical layout of the real physical platform; for the network, it is achieved by using an emulated/simulated network that behaves like a real MANET in some/all layers of the protocol stack. In this paper, we analyze the challenges and tradeoffs of realistic modeling of tactical networks with multilevel security (MLS), and present a case study of modeling BCTM-like manned ground vehicle (MGV) platforms in the VAN Testbed. Lessons learned during application development and testing performed on the model are also discussed.

Deadlock detection scheduling is an important, yet often overlooked problem that can significantly affect the overall performance of deadlock handling. Excessive initiation of deadlock detection increases overall message usage, resulting in degraded system performance in the absence of deadlocks; while insufficient initiation of deadlock detection increases the deadlock persistence time, resulting in an increased deadlock resolution cost in the presence of deadlocks. The investigation of this performance tradeoff, however, is missing in the literature. This paper studies the impact of deadlock detection scheduling on the overall performance of deadlock handling. In particular, we show that there exists an optimal deadlock detection frequency that yields the minimum long-run mean average cost, which is determined by the message complexities of the deadlock detection and resolution algorithms being used, as well as the rate of deadlock formation, denoted as $\lambda$. For the best known deadlock detection and resolution algorithms, we show that the asymptotically optimal frequency of deadlock detection scheduling that minimizes the overall message overhead is ${\cal O}((\lambda n)^{1/3})$, when the total number $n$ of processes is sufficiently large. Furthermore, we show that in general fully distributed (uncoordinated) deadlock detection scheduling cannot be performed as efficiently as centralized (coordinated) deadlock detection scheduling.

This paper describes an approach to root cause analysis and fault correlation that addresses the problems inherent in wireless military networks.1 Root cause analysis concerns itself with identifying and correcting problems in a network. The ultimate goal of root cause analysis is to diagnose the cause for network anomalies, towards the ultimate goal of ensuring that adequate communication functionality is maintained to support the requirements of the network users. In a wired network, the diagnosis of faults is easier due to the existence of a fixed, wired topology and fixed, wired links. In the wireless networks at the tactical edge of military networks, there is no hardwired connectivity, yet there are also expectations on the network from the end users which place constraints on the operation of the network. Fault diagnosis in such networks is fundamentally different from that in wired networks. The performance of the network must be managed explicitly with respect to its user expectations, even though the network connectivity is dynamic, the network monitoring traffic must traverse the (possibly failing) network itself, and the “correct” behavior of the network against which current network state needs to be compared evolves over time. The novel features of our solution that distinguish it from existing root cause analysis techniques are (a) a dynamic model of fault, performance and security problem propagation in the network that can evolve as the definition of network correctness changes, (b) a method for distributing reasoning over this model throughout the network into independent Correlators that share information through a set of Clearinghouses to provide a global root cause correlation capability, and (c) the ability for the Correlator and Clearinghouse reasoning to adapt gracefully when network problems prevent full exchange of information required for root cause analysis.

In this paper we describe ongoing work and a roadmap for developing enabling technologies to support testing and evaluation of tactical network management tools and their interoperability. Future tactical networks are mobile ad hoc networks, which greatly enhance network responsiveness but significantly increase network operations complexity. Due to the dynamic nature of such networks, testing and evaluation of functional correctness and communication performance of network management tools is a challenge. In addition, it is necessary to ensure that future tactical networks will be seamlessly integrated with each other and with existing military networks. To enable high-fidelity testing and evaluation of management tools and of their interoperability prior to costly and time-consuming field testing, we are developing technologies that can seamlessly integrate simulated networks, emulated networks, and real network devices into a virtual tactical network as a testbed. The goal of the testbed is to allow easy setup of different virtual tactical networks that behave like real networks, so that software tools for tactical networks can be effectively tested and evaluated.

Layer 2 radio resource allocation schemes being used in mobile ad hoc networks (MANET) do not always take into account the quality of service (QoS) requirements of network traffic. As an example, the current USAP (unifying slot assignment protocol) slot allocation scheme is QoS-unaware. Consequently the scheme could grant available slots to lower priority traffic instead of higher priority traffic. This greatly reduces the effectiveness of QoS management schemes at other layers of the protocol stack (e.g. DiffServ at layer 3, and admission control at the application layer). We describe a cross-layer solution to this problem where a local QoS control (LQC) component is placed on every node. The LQCs on nodes in a channelized neighborhood share their per traffic class radio resource needs, enabling the LQC at each node to determine its urgency for additional slots comparing to that of other nodes in the neighborhood. Thus, in nodes that have a less urgent need for slots, the LQC can filter local application traffic to reduce the local demand for slots, which in turn helps those nodes with more urgent need to have a better chance securing additional slots. A description of the approach and a performance analysis is presented.

Military Network Operations (NetOps) consist of three main components: network management, network defense (information assurance), and content staging (information dissemination management). NetOps capabilities include organizations, procedures, and technologies required to manage, defend, and utilize a network. Conventionally NetOps components are regarded as functionally orthogonal and operationally independent. However, based on our experience1 with the future Army tactical network that consist of mobile ad hoc networks (MANETs), we believe these components should be integrated to enhance NetOps in MANET environments. We envision that with the creation of an over-arching architectural framework to underlie NetOps components, future Army tactical network operations will provide better support to network centric warfare. Also, the focus of NetOps should transition from maintaining network operations to providing optimal communications. In this paper, we describe issues and challenges associated with integrating NetOps components for future Army tactical networks, and discuss path forward.

DRAMA1 is a distributed policy-based management system designed to manage Mobile Ad hoc NETworks (MANETs). Its design philosophy is to create intelligent, self-adaptive policy agents to manage dynamic networks without human intervention. Network management functions are performed in a distributed fashion by these policy agents, rather than being controlled by a centralized management station. Policies are used to control the frequency and content of network management messages exchanged among policy agents in a way that reduces bandwidth usage and increases the utility of management messages. This greatly enhances management efficiency and reduces the bandwidth overhead required for network management. As with any new technology, there is a question about the scalability of this approach. The purpose of the work described in this paper is to study whether the DRAMA policy-based network management system can scale to networks of 500+ nodes. The study uses a novel simulation-based approach to evaluate DRAMA performance when DRAMA is used to manage MANETs of up to 500 nodes. The results confirm that the DRAMA distributed policy-based management paradigm provides superior performance over a centralized management paradigm for MANETs.

The characteristics of ad hoc networks greatly increase the complexity of programming distributed applications with respect to both sending and receiving messages. This is because the network programming API based upon TCP and UDP was designed for the relatively stable, stationary Internet. The semantics of the API does not address the emerging issues from the dynamic mobile wireless ad hoc networks. One promising approach for alleviating this problem is to develop applications on top of a middleware system to shield applications from dealing with the dynamics of ad hoc networks. However, conventional middleware systems were not designed to cope with the frequently changing communications characteristics of military ad hoc networks. In order to address the above problem, we have designed and implemented a prototype of AMS , an Adaptive Middleware System with the following features. First, this middleware system is specifically designed to deal with dynamic and unreliable networks. Second, it shields communicating entities from coping with frequently changing networks via an API with semantics that provide a suitable abstraction of the underlying dynamic networks. Third, it allows individual applications to define their own communications requirements while the middleware system can set the lowest common requirements for all the communications per the military situations. Lastly, this middleware system has an interface that allows an external control system to adjust the values of its parameters to optimize the overall system performance.

In general, agent frameworks allow the functionality of their agents to be augmented with plug-ins, and agents in a multi-agent system collaborate with other agents to achieve their collective and/or individual goals. This model poses a few issues in terms of function coordination: (i) to allow the insertions of plug-ins on-the-fly, an agent framework needs to properly schedule the execution of plug-ins in a timely, coordinated fashion; (ii) plug-ins may conflict with each other in their behavior; and (in) agents may need to adapt their behavior based on their environments, in addition to coordinating their actions according to their objectives. Recent advances in policy-based management research suggest a promising direction to remedy the deficiency of existing software agent frameworks. We envision that the coordination between the plug-ins within an agent as well as the compliance of agents with environmental requirements can be achieved via policy control. With policy control, agents can adapt their behavior dynamically to meet the ever-changing environmental requirements such as those posed by military wireless ad hoc networks. In this paper, we present a novel software agent framework with seamlessly integrated policy control. We first describe the concept of policy control and how it is integrated into this framework. Next we explain the process of policy in action, discuss in detail the functions and benefits of policy control, and elaborate on the agent behavior adaptation that enables agents to achieve their goals while meeting dynamic environmental requirements.

YAP is a protocol designed to efficiently and robustly relay network configuration states of nodes to a designated node that collects and stores the configuration states of all the nodes. Once the configuration states from the nodes are collected, any application can query the information to perform its own specific function. For example, a GUI application can query the database to display the logical topology of the networks. Also a Configuration Manager can query the database to decide how to reconfigure the network. We describe how YAP was integrated with protocols designed to auto-configure IP-related attributes of nodes (using DRCP and DCDP).

We describe in this paper a novel design of a network management architecture that incorporates both agent and policy technologies. The conceptual model, main components, and various transports employed in this architecture are discussed. We believe that this network management architecture is highly scalable and capable of adapting network protocols and services on-the-fly with the goal of optimizing the efficiency of operations.

The popularity of instant messaging highlights the power that the addition of presence information can bring to communications. Instant messaging systems combine multi-party communications with active presence notifications, allowing users to monitor the presence status of others. We describe several ways presence information can enhance next generation telephone communications and how integration can actually improve instant messaging as well. In addition, we will describe some of the issues associated with implementing and deploying such services, including privacy, data ambiguity and inter-system compatibility.

Testing of applications for ad hoc networks poses a special technical challenge due to the difficulty of conducting experiments in an ad hoc network environment at a scale larger than a few nodes. One approach is to conduct experiments in a testbed that can imitate an ad hoc network. This requires the development of technologies that enable multiple instances of unmodified application software on a set of hosts to communicate via a simulated network that behaves like a real ad hoc network. In this paper, we describe the testbed developed under the virtual ad hoc network (VAN) testbed project for testing applications over ad hoc networks, with a special focus on network management applications. The testbed employs Xen-based virtualisation to achieve resource scalability. The infrastructure for the testbed provides an integrated platform consisting of virtual nodes running the actual software under test, augmented with a simulated network environment. Our goal is to enable software testing over large-scale (500-1000 nodes) ad hoc networks using the VAN testbed.