Computer Network Attacks Research Articles

Угрозы международной информационной безопасности: формирование концептуальных подходов

The article examines the main approaches to the formation and development of international legal regulation concerning threats to international information security. It examines the definition of information threats, as formulated in national (Russian) and international acts. Special attention is given to the reasonableness of the use of the term “information war” (Cyber warfare) from the point of view of international law. Also, the article attends to the special features of the concept of “computer network attack” in the international legal context. It analyses the issues relating to qualification of various acts which make the notion of “information threats” to international information security, and stresses for much needed search of new approaches to be applied to the given subject, also calls for departure from the existing methods of mechanical application of the existing norms, principles and institutions of international law to the regulation of information environment.

Research Distributed Attacks in Computer Networks

Research Distributed Attacks in Computer Networks

Detecting Simulated Attacks in Computer Networks Using Resilient Propagation Artificial Neural Networks

In a large network, it is extremely difficult for an administrator or security personnel to detect which computers are being attacked and from where intrusions come. Intrusion detection systems using neural networks have been deemed a promising solution to detect such attacks. The reason is that neural networks have some advantages such as learning from training and being able to categorize data. Many studies have been done on applying neural networks in intrusion detection systems. This work presents a study of applying resilient propagation neural networks to detect simulated attacks. The approach includes two main components: the Data Pre- processing module and the Neural Network. The Data Pre- processing module performs normalizing data function while the Neural Network processes and categorizes each connection to find out attacks. The results produced by this approach are compared with present approaches.

Research on Computer Network Security and Prevention Strategy

With the development and popularization of the computer network, the security problem has increasingly become the focus of common concern. The computer network safety problems mainly include: protocol design issues, awareness, management system and technical operation. Hackers on the computer network attack techniques: Deceptive attack, masquerade attacks, vulnerability attack, covert attack and technical attack. Accordingly, we should take the corresponding safety countermeasures: strengthen network security education, using the network protection technology, detection technology and anti-virus technology. This paper mainly analyzes the defects and the security problems of computer network, discusses about the maintenance of computer network security and the way for computer network attack technology defense strategy.

The Notion of Combatancy in Cyber Warfare

The class of combatant constitutes one of the most important instrumentalities of the law of war. Combatant status resolves critical and enduring legal questions such as immunity from prosecution for warlike acts, susceptibility to intentional targeting, and, in part, treatment upon capture. Since the late nineteenth century, codifications of the international law of war have included criteria for combatant status keyed to ensuring desirable battlefield conduct and, to the extent possible, humanity in war. This paper revisits the author's prior work on the topic of combatancy in cyber warfare. Building on recent public revelations concerning state capacity for offensive cyber attacks, as well as new developments in computer network attack, this paper highlights logical and normative shortcomings in current understandings of combatant status in cyberspace. In place of rote reliance on existing criteria intended for the kinetic battlefield, this paper proposes reliance on State affiliation as the sole criterion for evaluating combatant status in cyber warfare between States. An admitted interpretive gloss on current criteria, the proposed framework offers a workable and realistic reconciliation of humanitarian goals and emerging State practice in cyber warfare.

NEURAL NETWORK APPROACHES FOR INTRUSION DETECTION AND RECOGNITION

Most current Intrusion Detection Systems (IDS) examine all data features to detect intrusion. Also existing intrusion detection approaches have some limitations, namely impossibility to process large number of audit data for real-time operation, low detection and recognition accuracy. To overcome these limitations, we apply modular neural network models to detect and recognize attacks in computer networks. It is based on combination of principal component analysis (PCA) neural networks and multilayer perceptrons (MLP). PCA networks are employed for important data extraction and to reduce high dimensional data vectors. We present two PCA neural networks for feature extraction: linear PCA (LPCA) and nonlinear PCA (NPCA). MLP is employed to detect and recognize attacks using feature-extracted data instead of original data. The proposed approaches are tested using KDD-99 dataset. The experimental results demonstrate that the designed models are promising in terms of accuracy and computational time for real world intrusion detection.

Applicability of Jus in Bello in Cyber Space

Computer network attack as a method of warfare has been casting confusing mist upon the application of jus in bello in recent years. Observing that many states are implementing more and more aggressive cyber strategy, an examination of applicable law regulating cyber warfare becomes crucially important. This paper attempts to review the traditional norms of jus in bello and explore their defects in the context of cyber space. Accordingly, in the fist part the author provides the brief introduction of conventional jus in bello and its application in kinetic warfare. Further, the second part explains some special natures of the use of cyber tools in warfare and the third part analyzes the problems of applying the traditional jus in bello in cyber space. Last but not least, the final part gives some conclusive remarks and points out the solutions would be to initiate more international co-operation.

Computer Network Attacks and Modern International Law

Computer network attacks (CNA) is a no doubt actual theoretical and practical topic today. Espionage, public and private computer-systems disruptions committed by states have been a real life. States execute CNA's involving its agents or hiring private hacker groups. However, the application of lex lata remains unclear in practice and still undeveloped in doctrine. Nevertheless the international obligations, which states have accepted under the UN Charter and other treaties as well as customs - with any related exemptions and reservations - are still in force and create a legal framework, which one cannot ignore. Taking into account the intensity level or the consequences of a CNA the later could be considered as an unfriendly, but legal doing, or, as a use of force (prohibited under the article 2(4) of the UN Charter), or - in the case the proper threshold is taken - as an armed attack (which gives the victim-state the right to use force in self-defence under the customs and the article 51 of the UN Charter). Researches in the field of lex lata applicability to the CNAs could highlight gaps and week points of the nowadays legal regime. The subject is on agenda in western doctrine, and it is a pity - not in Russian one - the number of publication here is still unsatisfied. The article formulates issues related to CNAs and the modern international legal regime. The author explores the definition, legal volume of the term CNA, highlights main issues, which have to be analyzed from the point of the contemporary law.

Decision Diagram-Based Modeling of Network Reachability

The computer network attack graph generation method obtained mostly through network scanning, this network reachability information, this approach takes a long presence information and incomplete defects by analyzing network reachability main task of research and developing trends is proposed based on binary decision diagrams algorithm approach to achieve network reachability studies. The algorithm uses the decision diagram modeling firewall rules, through the collection operations to achieve network reachability studies.

Secure the edge? Understanding the risk towards wireless grids Edgeware technology

This article contributes to the foundational understanding of the security vulnerabilities and risk towards wireless grid Edgeware technology. Since communication networks and devices are subject to becoming the target of exploitation by hackers (e.g., individuals who attempt to gain unauthorised access to computer systems), these individuals are gaining ever-increasing knowledge of the often widely-reported exploitable vulnerabilities in these types of innovative technologies; and thus are able to craft increasingly effective computer network attacks (CNA) against such technologies. This research responds to the overall proposition: what security vulnerability enumerations would contribute to the degradation and risk in using a wireless grid Edgeware application in a virtualised cloud environment? Using supporting research pertaining to cyber-attacks and vulnerabilities towards a wireless cloud (e.g., the integration of a cloud computing and a wireless grid architecture), security vulnerabilities in virtualisation environments and specific vulnerabilities exploited against a wireless grid Edgeware application, this research provides a greater understanding of the practical ways wireless grid Edgeware technology can be attacked and the risk in utilising this technology.

Repurposing Cyber Command

ABSTRACT: Recent debates about the organizational relationship between Cyber Command and the NSA stress political issues over force employment. This article focuses on the latter, making the case that Cyber Command should be split from the NSA, because nations that marshal and mobilize their cyber power and integrate it into strategy and doctrine will ensure significant national security advantage. Cyber Command provides the best route for developing the tactics, techniques, and procedures necessary for achieving these goals. ********** For twenty years, members of the United States' national security community, including readers of this journal, have debated the potential tactical, operational, and strategic effects of cyber components and capabilities. (1) Recently, these discussions have become intertwined with arguments about the organizational relationships as well as the Title 10 (traditional military) and Title 50 (intelligence and covert) authorities that exist under the Unified Command Plan. Because of this expanding controversy, there is a growing chorus calling for a split between the National Security Agency (NSA) and US Cyber Command. These debates are important. Yet they subsume the pivotal issue --how cyber components and capabilities will affect US national security--beneath more transient legal and political issues generated in the wake of Edward Snowden. Furthermore, past and current debates often overlook a basic truth: battlefield outcomes and strategic effects are the product of actual force employment, not theoretical arguments or proving-ground tests. Cyber Command should be cleaved from NSA, but not for reasons of political expediency. Cyber Command should be split from NSA because the United States needs an organizational arrangement that provides for the development and normalization of Title 10 and Title 50 cyber capabilities, while maintaining a focus on how such will affect the use of military force and US national security. Cyber Command should be split from the NSA because nations that marshal and mobilize their cyber power and integrate it into strategy and doctrine will ensure significant national security advantage, and Cyber Command currently provides the best route for achieving such. (2) Cyber Command should be removed from under US Strategic Command and established as a unified combatant command. That action represents the most effective means for developing and maturing the tactics, techniques, and procedures that will allow US cyber components and capabilities to be employed for military purposes and to generate strategic effects. Currently, there are two primary reasons why the establishment of a unified combatant command presents a better solution than tasking existing branch and service structures. First, speed is of the essence. Tasking an existing branch or service, or even establishing a new service, would open up organizational and bureaucratic rivalries likely to slow (if not cripple) the development of cyber components and capabilities. Second, in the near term, Title 10 and Title 50 concerns, vagueness in the cyber rules of engagement, concerns about political blowback, and fears that US cyber weapons could be reverse engineered and used against the United States, all highlight the importance of an organizational solution that synchronizes and deconflicts activities across the whole of government. In short, the United States needs a combatant command that can do two things: (1) craft the tactical, operational, and strategic cyber capabilities US national security will need in the decades to come; and, (2) oversee their application, integration, and execution. Cyber Command is the best choice and now is the time to act. Operationalizing Cyber When Cyber Command was established in 2009, it made sense that it be stood up as a sub-unified command under Strategic Command. Until recently the line between computer network attacks and computer network exploits was chiefly one of intent (i. …

Human Factors in Cyber Warfare

There has been a dramatic increase in the total number of reported cyber security breaches and attacks in recent years. In response, government, and corporate entities have invested billions of dollars in funding research and development efforts for cyber operations, including computer network defense (CND) and computer network attack (CNA). While cyber operations have become an important national priority over the last decade, the Human Factors community has yet to approach it with critical mass. In its purest form, cyber operations are a complex sociotechnical system that can have effects across all levels of an organization. Due to a consistent interplay between human cognition, technology, and organizational constraints within the environment, the Human Factors community is particularly well-suited to address the problem space. We have assembled a panel of six scientists, technologists, and subject matter experts across multiple specializations in the Human Factors community to help begin this increasingly important discussion. The goal of this panel is to have an open discussion on how we can leverage our specializations and expertise to address the cyber operations landscape as a community.

Intrusion Detection System based on Learning Fuzzy Rules and Membership Functions using Genetic Algorithms

With the rapid expansion of Internet in recent years, computer systems are facing increased number of security threats. Despite numerous technological innovations for information assurance, it is still very difficult to protect computer systems. Therefore, unwanted intrusions take place when the actual software systems are running. Different soft computing based approaches have been proposed to detect computer network attacks. Hybrid methods proved more effective and accurate, this paper tries to introduce how to use dynamic fuzzy rules and genetic algorithm in intrusion detection systems.

The VAST Challenge: history, scope, and outcomes: An introduction to the Special Issue

The annual Visual Analytics Science and Technology (VAST) challenge provides Visual Analytics researchers, developers, and designers an opportunity to apply their best tools and techniques against invented problems that include a realistic scenario, data, tasks, and questions to be answered. Submissions are processed much like conference papers, contestants are provided reviewer feedback, and excellence is recognized with awards. A day-long VAST Challenge workshop takes place each year at the IEEE VAST conference to share results and recognize outstanding submissions. Short papers are published each year in the annual VAST proceedings. Over the history of the challenge, participants have investigated a wide variety of scenarios, such as bioterrorism, epidemics, arms smuggling, social unrest, and computer network attacks, among many others. Contestants have been provided with large numbers of realistic but synthetic Coast Guard interdiction records, intelligence reports, hospitalization records, microblog records, personal RFID tag locations, huge amounts of cyber security log data, and several hours of video. This paper describes the process for developing the synthetic VAST Challenge datasets and conducting the annual challenges. This paper also provides an introduction to this special issue of Information Visualization, focusing on the impacts of the VAST Challenge.

Tools and Technologies for Professional Offensive Cyber Operations

Since 2008, several countries have published new national cyber security strategies that allow for the possibility of offensive cyber operations. Typically, national strategies call for the establishment of a cyber operations unit capable of computer network defence, exploitation, and, in some nations, attack. The cyber operations unit will be manned by professionals and operate under government authority compliant with national and international law. Our research focuses on offensive cyber operations (i.e. computer network exploitation and attack). The cyber unit must be provided with the right resources, in the form of accommodation, computing and networking infrastructure, tools and technologies, doctrine, and training. We contend that the open literature gives an unbalanced view of what tools and technologies a professional group needs because it emphasizes malware and, to a lesser extent, the delivery media used by cyber criminals. Hence, the purpose of this paper is to identify systematically the tools and technologies needed for professional, offensive cyber operations. A canonical model of the cyber attack process was obtained by rationally reconstructing a set of existing attack process models found in the literature. This canonical model was formalized using Structured Analysis and Design Technique (SADT) notation, in which processes are logically linked by inputs, outputs, controls, and mechanisms. A set of tools and technologies was extracted from the mechanisms. The canonical model and set of tools and technologies have been checked by subject matter experts.

Stuxnet and the Limits of Cyber Warfare

Stuxnet, the computer worm which disrupted Iranian nuclear enrichment in 2010, is the first instance of a computer network attack known to cause physical damage across international boundaries. Some have described Stuxnet as the harbinger of a new form of warfare that threatens even the strongest military powers. The influential but largely untested Cyber Revolution thesis holds that the internet gives militarily weaker actors asymmetric advantages, that offense is becoming easier while defense is growing harder, and that the attacker's anonymity undermines deterrence. However, the empirical facts of Stuxnet support an opposite interpretation; cyber capabilities can marginally enhance the power of stronger over weaker actors, the complexity of weaponization makes cyber offense less easy and defense more feasible than generally appreciated, and cyber options are most attractive when deterrence is intact. Stuxnet suggests that considerable social and technical uncertainties associated with cyber operations may significantly blunt their revolutionary potential.

Using Feature Selection and Classification Scheme for Automating Phishing Email Detection

Email has become the critical communication medium for most organizations. Unfortunately, email-born attacks in computer networks are causing considerable economic losses worldwide. Exiting phishing email blocking appliances have little effect in weeding out the vast majority of phishing emails. At the same time, online criminals are becoming more dangerous and sophisticated. Phishing emails are more active than ever before and putting the average computer user and organizations at risk of significant data, brand and financial loss. In this paper, we propose a hybrid feature selection approach based combination of content-based and behaviour-based. The approach could mine the attacker behaviour based on email header. On a publicly available test corpus, our hybrid features selection is able to achieve 94% accuracy rate.

Cyberwarfare and State Responsibility

An attempt to establish a link between the rules on State responsibility and Computer Network Attacks and assess the potential for using it as a possible reference point for developing a set of rules specifically tailored to regulate such attacks.

Computer Network Security and Precaution Evaluation based on Incremental Relevance Vector Machine Algorithm and ACO

Abstract It is well-known that the correct evaluation for computer network attack is very significant to avoid computer network attack. In order to improve the generalization performance of relevance vector machine, an incremental relevance vector machine algorithm(IRVM) based on ant colony optimization (ACO) is firstly presented and applied to computer network attack evaluation in the paper. In the experiments, we collect 85 samples of KDDCUP99 datasets as our experimental data, the detection accuracy of the hybrid algorithm of ACO and relevance vector machine is 97.65%, and the detection accuracy of the hybrid algorithm of relevance vector machine is 94.12%.It is shown that the detection accuracy of the hybrid algorithm of ACO and relevance vector machine for computer network attack is higher than that of relevance vector machine.

A dynamic approach to generate behavior patterns of Virus and Worms for Intrusion Detection System

In today’s society people become more and more dependent on computer systems. It is therefore vital that such systems are up and running at all times. One factor that has the power to destroy the availability is computer network attacks (CNA). (CNA are defined as methods aimed at destroying, altering or obstructing information in computers, computer networks or the networks themselves). Unfortunately, the Internet show an increasing trend regarding the usage of malicious activities such as intrusion attempts, denial-of-service attacks, phishing, spamming and worms. Some automated attacks can compromise a large number of computers in a short period of time. To try to minimize this threat, it would be nice to have a security system which has the ability to detect new attacks and react on them. This work focuses on seeing how good IDS rules that can be generated automatically based on data logged by a simple honypot. The result will be based on data collected by a network intrusion detection system named SNORT, a low-interaction honeypot named honeyd and a vulnerability scanner named Nessus. Keywords: Intrusion Detection, Honey pots, Longest common Substring, Worms, Confusion matrix