Threat Detection Through Correlation of Network Flows and Logs

A rising amount of mutually interconnected and communicating devices puts increasing demands on cybersecurity operators and their tools. With the rise of end-to-end encryption, it is becoming increasingly difficult to detect threats in network traffic. With such motivation, this Ph.D. proposal aims to find new methods for automatic detection of threats hiding in encrypted channels. The focus of the proposal is on correlating the data still available in the encrypted network flows with the data contained in the logs of network applications. Our research is in the initial phase and will contribute to a Ph.D. thesis in four years

Enriching DNS Flows with Host-Based Events to Bypass Future Protocol Encryption

Monitoring of host-based events and network flows are the two most common techniques for collecting and analyzing cybersecurity data. However, events and flows are either monitored separately or correlated as alerts in higher aggregated forms. The event-flow correlation on the monitoring level would match related events and flows together and enabled observing both data in near real-time. This approach allows substituting application-level flow information that will not be available due to encryption, which is being employed in a number of communication protocols. In this paper, we performed the event-flow correlation of the DNS protocol. We developed a general model that describes the relation between events and flows to enable an accurate time-based correlation where parameter-based correlation is not feasible. Based on the model, we designed three event-flow correlation methods based on common parameters and times of occurrence. We evaluated the correlation methods using a recent and public dataset, both with and without the extended flow information, to simulate DNS flow encryption. The results of the method combining parameter-based and time-based matching show that matching related DNS events to flows is possible and substitutes the data that might soon be lost in encryption

Traffic and Log Data Captured During a Cyber Defense Exercise

Cybersecurity research relies on relevant datasets providing researchers a snapshot of network traffic generated by current users and modern applications and services. The lack of datasets coming from a realistic network environment leads to inefficiency of newly designed methods that are not useful in practice. This data article provides network traffic flows and event logs (Linux and Windows) from a two-day cyber defense exercise involving attackers, defenders, and fictitious users operating in a virtual exercise network. The data are stored as structured JSON, including data schemes and data dictionaries, ready for direct processing. Network topology of the exercise network in NetJSON format is also provided

DNS Firewall Data Visualization

Common security tools generate a lot of data suitable for further analysis. However, the raw form of the data is often too complex and useful information gets lost in a large volume of records. In this paper, we propose a system for visualization of the data generated by a DNS firewall and outline a process of visually emphasizing information important to incident handlers. Our prototype suggests that such visualization is possible, keeping the balance between the amount of displayed information and the level of detail

Software pro aplikaci reaktivních opatření na prvcích aktivní obrany počítačové sítě

Software implementuje sadu nástrojů pro podporu automatizovaných a asistovaných reakcí na bezpečnostní události pomocí prvků aktivní obrany v prostředí chráněné vnitřní sítě. Software udržuje přehled o dostupných prvcích aktivní obrany a zpracovává vstupní příkazy od bezpečnostních operátorů nebo automatizovaných bezpečnostních systémů. Tyto příkazy kontroluje, rozděluje a vykonává na příslušných prvcích aktivní obrany s ohledem na jejich funkci, dostupnost, a volnou kapacitu. Aktuální stav prvků aktivní obrany a výsledky prováděných operací software zobrazuje v samostatné aplikaci dashboardu.Software implementuje sadu nástrojů pro podporu automatizovaných a asistovaných reakcí na bezpečnostní události pomocí prvků aktivní obrany v prostředí chráněné vnitřní sítě. Software udržuje přehled o dostupných prvcích aktivní obrany a zpracovává vstupní příkazy od bezpečnostních operátorů nebo automatizovaných bezpečnostních systémů. Tyto příkazy kontroluje, rozděluje a vykonává na příslušných prvcích aktivní obrany s ohledem na jejich funkci, dostupnost, a volnou kapacitu. Aktuální stav prvků aktivní obrany a výsledky prováděných operací software zobrazuje v samostatné aplikaci dashboardu.The software implements a set of tools to support automated and assisted responses to security events using devices for active network defense in a protected internal network environment. The software maintains an overview of available active network defense devices and processes input commands from security operators or automated security systems. It controls, distributes and executes these commands on the relevant devices with regard to their function, availability, and free capacity. The software displays the current status of active network defense devices and the results of performed operations in a separate dashboard application

Current Issues of Malicious Domains Blocking

Cyberattackers often use the Domain Name System (DNS) in their activities. Botnet C&C servers and phishing websites both use DNS to facilitate connection to or from its victims, while the protocol does not contain any security countermeasures to thwart such behavior. In this paper, we examine capabilities of a DNS firewall that would be able to filter access from the protected network to known malicious domains on the outside network. Considering the needs of Computer Security Incident Response Teams (CSIRTs), we formulated functional requirements that a DNS firewall should fulfill to fit the role of a cybersecurity tool. Starting from these requirements, we developed a DNS firewall based on the DNS Response Policy Zones technology, the only suitable open source technology available yet. However, we encountered several essential limitations in the DNS RPZ technology during the testing period. Still, our testing results show that simple DNS firewall can prevent attacks not detected by other cybersecurity tools. We discuss the limitations and propose possible solutions so that the DNS firewall might be used as a more complex cybersecurity tool in the future. Lessons learned from the deployment show that while the DNS firewall can indeed be used to block access to malicious domains, it cannot yet satisfy all the requirements of cybersecurity teams

Using TLS Fingerprints for OS Identification in Encrypted Traffic

Asset identification plays a vital role in situational awareness building. However, the current trends in communication encryption and the emerging new protocols turn the well-known methods into a decline as they lose the necessary data to work correctly. In this paper, we examine the traffic patterns of the TLS protocol and its changes introduced in version 1.3. We train a machine learning model on TLS handshake parameters to identify the operating system of the client device and compare its results to well-known identification methods. We test the proposed method in a large wireless network. Our results show that precise operating system identification can be achieved in encrypted traffic of mobile devices and notebooks connected to the wireless network.Asset identification plays a vital role in situational awareness building. However, the current trends in communication encryption and the emerging new protocols turn the well-known methods into a decline as they lose the necessary data to work correctly. In this paper, we examine the traffic patterns of the TLS protocol and its changes introduced in version 1.3. We train a machine learning model on TLS handshake parameters to identify the operating system of the client device and compare its results to well-known identification methods. We test the proposed method in a large wireless network. Our results show that precise operating system identification can be achieved in encrypted traffic of mobile devices and notebooks connected to the wireless network

CRUSOE: A Toolset for Cyber Situational Awareness and Decision Support in Incident Handling

The growing size and complexity of today’s computer network make it hard to achieve and maintain so-called cyber situational awareness, i.e., the ability to perceive and comprehend the cyber environment and be able to project the situation in the near future. Namely, the personnel of cybersecurity incident response teams or security operation centers should be aware of the security situation in the network to effectively prevent or mitigate cyber attacks and avoid mistakes in the process. In this paper, we present a toolset for achieving cyber situational awareness in a large and heterogeneous environment. Our goal is to support cybersecurity teams in iterating through the OODA loop (Observe, Orient, Decide, Act). We designed tools to help the operator make informed decisions in incident handling and response for each phase of the cycle. The Observe phase builds on common tools for active and passive network monitoring and vulnerability assessment. In the Orient phase, the data on the network are structured and presented in a comprehensible and visually appealing manner. The Decide phase opens opportunities for decision-support systems, in our case, a recommender system that suggests the most resilient configuration of the critical infrastructure. Finally, the Act phase is supported by a service that orchestrates network security tools and allows for prompt mitigation actions. Finally, we present lessons learned from the deployment of the toolset in the campus network and the results of a user evaluation study

Analyzing an Off-the-Shelf Surveillance Software: Hacking Team Case Study

In July 2015, a major distributor and developer of covert surveillance tools, Italian company Hacking Team, has been hacked. Due to the attack, nearly 400 GB of internal data leaked on sharing networks. The data contained the latest version of the surveillance software named Galileo, including full technical and user documentation. We use this opportunity to examine key features of surveillance software that was designed for governmental agencies and its specification was kept secret. In this paper, we deploy the system in an isolated virtual environment and test its behavior during a surveillance operation. We use collected information to classify the advancement level of Galileo among similar mass-spread malware and the advanced persistent threats tools. With the hindsight of nearly two years, it is also possible to evaluate the impact the data leak had.In July 2015, a major distributor and developer of covert surveillance tools, Italian company Hacking Team, has been hacked. Due to the attack, nearly 400 GB of internal data leaked on sharing networks. The data contained the latest version of the surveillance software named Galileo, including full technical and user documentation. We use this opportunity to examine key features of surveillance software that was designed for governmental agencies and its specification was kept secret. In this paper, we deploy the system in an isolated virtual environment and test its behavior during a surveillance operation. We use collected information to classify the advancement level of Galileo among similar mass-spread malware and the advanced persistent threats tools. With the hindsight of nearly two years, it is also possible to evaluate the impact the data leak had

Towards Provable Network Traffic Measurement and Analysis via Semi-Labeled Trace Datasets

Research in network traffic measurement and analysis is a long-lasting field with growing interest from both scientists and the industry. However, even after so many years, results replication, criticism, and review are still rare. We face not only a lack of research standards, but also inaccessibility of appropriate datasets that can be used for methods development and evaluation. Therefore, a lot of potentially high-quality research cannot be verified and is not adopted by the industry or the community. The aim of this paper is to overcome this controversy with a unique solution based on a combination of distinct approaches proposed by other research works. Unlike these studies, we focus on the whole issue covering all areas of data anonymization, authenticity, recency, publicity, and their usage for research provability. We believe that these challenges can be solved by utilization of semi-labeled datasets composed of real-world network traffic and annotated units with interest-related packet traces only. In this paper, we outline the basic ideas of the methodology from unit trace collection and semi-labeled dataset creation to its usage for research evaluation. We strive for this proposal to start a discussion of the approach and help to overcome some of the challenges the research faces today