Next Generation Attacks on the Internet

Over the past few years we have seen the use of Internet worms, i.e., malicious self-replicating programs, as a mechanism to rapidly invade and compromise large numbers of remote computers. Although the first worms released on the Internet were large-scale easy to- spot massive security incidents, also known as flash worms, it is currently envisioned that future worms will be increasingly difficult to detect, and will be known as stealth worms. This is partly because the motives of the first worm developers were centered around the self-gratification brought by the achievement of compromising large numbers of remote computers, the motives of recent worm and malware developers are centered around financial and political gains. Therefore, although recent attackers still want to be able to control a large number of compromised computers, they prefer to compromise these computers as quietly as possible, over a longer period of time, so as not to be detected by any security defenses. Thus, to achieve a stealthy behavior, these attackers have started using, or at least have the capacity to use a wide variety of mechanisms that will make their worms more difficult to detect

PROVIDE: hiding from automated network scans with proofs of identity

Network scanners are a valuable tool for researchers and administrators, however they are also used by malicious actors to identify vulnerable hosts on a network. Upon the disclosure of a security vulnerability, scans are launched within hours. These opportunistic attackers enumerate blocks of IP addresses in hope of discovering an exploitable host. Fortunately, defensive measures such as port knocking protocols (PKPs) allow a service to remain stealth to unauthorized IP addresses. The service is revealed only when a client includes a special authentication token (AT) in the IP/TCP header. However this AT is generated from a secret shared between the clients/servers and distributed manually to each endpoint. As a result, these defense measures have failed to be widely adopted by other protocols such as HTTP/S due to challenges in distributing the shared secrets. In this paper we propose a scalable solution to this problem for services accessed by domain name. We make the following observation: automated network scanners access servers by IP address, while legitimate clients access the server by name. Therefore a service should only reveal itself to clients who know its name. Based on this principal, we have created a proof of the verifier’s identity (a.k.a. PROVIDE) protocol that allows a prover (legitimate user) to convince a verifier (service) that it is knowledgeable of the verifier’s identity. We present a PROVIDE implementation using a PKP and DNS (PKP+DNS) that uses DNS TXT records to distribute identification tokens (IDT) while DNS PTR records for the service’s domain name are prohibited to prevent reverse DNS lookups. Clients are modified to make an additional DNS TXT query to obtain the IDT which is used by the PKP to generate an AT. The inclusion of an AT in the packet header, generated from the DNS TXT query, is proof the client knows the service’s identity. We analyze the effectiveness of this mechanism with respect to brute force attempts for various strength ATs and discuss practical considerations.This work has been supported by the National Science Foundation (NSF) awards #1430145, #1414119, and #1012798

Towards automated distributed containment of zero-day network worms

Worms are a serious potential threat to computer network security. The high potential speed of propagation of worms and their ability to self-replicate make them highly infectious. Zero-day worms represent a particularly challenging class of such malware, with the cost of a single worm outbreak estimated to be as high as US$2.6 Billion. In this paper, we present a distributed automated worm detection and containment scheme that is based on the correlation of Domain Name System (DNS) queries and the destination IP address of outgoing TCP SYN and UDP datagrams leaving the network boundary. The proposed countermeasure scheme also utilizes cooperation between different communicating scheme members using a custom protocol, which we term Friends. The absence of a DNS lookup action prior to an outgoing TCP SYN or UDP datagram to a new destination IP addresses is used as a behavioral signature for a rate limiting mechanism while the Friends protocol spreads reports of the event to potentially vulnerable uninfected peer networks within the scheme. To our knowledge, this is the first implementation of such a scheme. We conducted empirical experiments across six class C networks by using a Slammer-like pseudo-worm to evaluate the performance of the proposed scheme. The results show a significant reduction in the worm infection, when the countermeasure scheme is invoked

Model-driven situational awareness for moving target defense

Moving Target Defense (MTD) presents dynamically changing attack surfaces and system configurations to attackers. This approach decreases the success probabilities of attacks and increases attacker's workload since she must continually re-assess, re-engineer and re-launch her attacks. Existing research has provided a number of MTD techniques but approaches for gaining situational awareness and deciding when/how to apply these techniques are not well studied. In this paper, we present a conceptual framework that closely integrates a set of models with the system and obtains up-to-date situational awareness following the OODA loop methodology. To realize the framework, as the first step, we propose a modelling approach that provides insights about the dynamics between potential attacks and defenses, impact of attacks and adaptations on the system, and the state of the system. Based on these models, we demonstrate techniques to quantitatively assess the effectiveness of MTD and show how to formulate decision-making problems

Geometry-based Detection of Flash Worms

While it takes traditional internet worms hours to infect all the vulnerable hosts on the Internet, a flash worm takes seconds. Because of the rapid rate with which flash worms spread, the existing worm defense mechanisms cannot respond fast enough to detect and stop the flash worm infections. In this project, we propose a geometric-based detection mechanism that can detect the spread of flash worms in a short period of time. We tested the mechanism on various simulated flash worm traffics consisting of more than 10,000 nodes. In addition to testing on flash worm traffics, we also tested the mechanism on non-flash worm traffics to see if our detection mechanism produces false alarms. In order to efficiently analyze bulks of various network traffics, we implemented an application that can be used to convert the network traffic data into graphical notations. Using the application, the analysis can be done graphically as it displays the large amount of network relationships as tree structures

Characterizing the Power of Moving Target Defense via Cyber Epidemic Dynamics

Moving Target Defense (MTD) can enhance the resilience of cyber systems against attacks. Although there have been many MTD techniques, there is no systematic understanding and {\em quantitative} characterization of the power of MTD. In this paper, we propose to use a cyber epidemic dynamics approach to characterize the power of MTD. We define and investigate two complementary measures that are applicable when the defender aims to deploy MTD to achieve a certain security goal. One measure emphasizes the maximum portion of time during which the system can afford to stay in an undesired configuration (or posture), without considering the cost of deploying MTD. The other measure emphasizes the minimum cost of deploying MTD, while accommodating that the system has to stay in an undesired configuration (or posture) for a given portion of time. Our analytic studies lead to algorithms for optimally deploying MTD.Comment: 12 pages; 4 figures; Hotsos 14, 201

Алгоритм и технические решения динамического конфигурирования клиент-серверных вычислительных сетей

Проанализированы основные факторы, обуславливающие расширение возможностей и повышение результативности сетевой разведки по идентификации состава и структуры клиент-серверных вычислительных сетей вследствие стационарности их структурно-функциональных характеристик. Вскрытые особенности защиты клиент-серверных вычислительных сетей, основанных на реализации принципов пространственного обеспечения безопасности, а также формализация и внедрение множества запрещающих регламентов обосновывают актуальность задачи динамического управления структурно-функциональными характеристиками клиент-серверных вычислительных сетей, функционирующих в условиях сетевой разведки. Представлена математическая модель, позволяющая находить оптимальные режимы динамического конфигурирования структурно-функциональных характеристик клиент-серверных вычислительных сетей для различных ситуаций. Приведены результаты расчетов. Представлен алгоритм решения задачи динамической конфигурации структурно-функциональных характеристик клиент-серверной вычислительной сети, обеспечивающий уменьшение времени достоверности добываемых сетевой разведкой данных. Показаны результаты практических испытаний разработанного на основе алгоритма динамического конфигурирования клиент-серверных вычислительных сетей программного обеспечения. Полученные результаты свидетельствуют, что использование представленного решения по динамическому конфигурированию клиент-серверных вычислительных сетей позволяет повысить результативность защиты за счет изменения структурно-функциональных характеристик клиент-серверных вычислительных сетей в рамках нескольких подсетей. При этом достигнуто поддержание критически важных соединений, а интервалы времени изменения структурно-функциональных характеристик адаптивны к условиям функционирования и действиям злоумышленника. Новизна разработанной модели заключается в применении математического аппарата теории марковских случайных процессов и решении уравнений Колмогорова для обоснования выбора режимов динамического конфигурирования структурно-функциональных характеристик клиент-серверных вычислительных сетей. Новизна разработанного алгоритма состоит в применении модели динамического конфигурирования структурно-функциональных характеристик клиент-серверных вычислительных сетей для динамического управления структурно-функциональными характеристиками клиент-серверной вычислительной сети в условиях сетевой разведки

Evaluating the Effectiveness of IP Hopping via an Address Routing Gateway

This thesis explores the viability of using Internet Protocol (IP) address hopping in front of a network as a defensive measure. This research presents a custom gateway-based IP hopping solution called Address Routing Gateway (ARG) that acts as a transparent IP address hopping gateway. This thesis tests the overall stability of ARG, the accuracy of its classifications, the maximum throughput it can support, and the maximum rate at which it can change IPs and still communicate reliably. This research is accomplished on a physical test network with nodes representing the types of hosts found on a typical, corporate-style network. Direct measurement is used to obtain all results for each factor level. Tests demonstrate ARG classifies traffic correctly, with no false negatives and less than a 0.15% false positive rate on average. The test environment conservatively shows this to be true as long as the IP address change interval exceeds two times the network\u27s round-trip latency; real-world deployments may allow for more frequent hopping. Results show ARG capably handles traffic of at least four megabits per second with no impact on packet loss. Fuzz testing validates the stability of ARG itself, although additional packet loss of around 23% appears when under attack