Computer Network Attacks Research Articles

A knowledge integration framework for complex network management

PurposeLarge supply and computer networks contain heterogeneous information and correlation among their components, and are distributed across a large geographical region. This paper aims to investigate and develop a generic knowledge integration framework that can handle the challenges posed in complex network management. It also seeks to examine this framework in various applications of essential management tasks in different infrastructures.Design/methodology/approachEfficient information and knowledge integration technologies are key to capably handling complex networks. An adaptive fusion framework is proposed that takes advantage of dependency modelling, active configuration planning and scheduling, and quality assurance of knowledge integration. The paper uses cases of supply network risk management and computer network attack correlation (NAC) to elaborate the problem and describe various applications of this generic framework.FindingsInformation and knowledge integration becomes increasingly important, enabled by technologies to collect and process data dynamically, and faces enormous challenges in handling escalating complexity. Representing these systems into an appropriate network model and integrating the knowledge in the model for decision making, directed by information and complexity measures, provide a promising approach. The preliminary results based on a Bayesian network model support the proposed framework.Originality/valueFirst, the paper discussed and defined the challenges and requirements faced by knowledge integration in complex networks. Second, it proposed a knowledge integration framework that systematically models various network structures and adaptively integrates knowledge, based on dependency modelling and information theory. Finally, it used a conceptual Bayesian model to elaborate the application to supply chain risk management and computer NAC of this promising framework.

A Critical Look at Restaurant Network Security

This study investigated the information technology (IT) security practices and prevention techniques of restaurants. A random sample of 1,143 restaurant IT managers were selected from the Hospitality Technology Magazine subscribers. The survey was completed by 116 restaurant information technology (IT) managers. Twenty-four percent of the restaurant networks had a computer network attack within the last 12 months. On average, the restaurants received 1-5 network attacks within the last 12 months. A security index (SI), the total number of security tools utilized, was created for each respondent. The size of the restaurant (number of units) was positively correlated with the security index, and the total number of network security tools utilized by restaurants. Regarding attack types, “Virus Attack” (71.4%) was reported most frequently, followed by “Insider Abuse of Net Access” (57.1%) and “Laptop Theft” (42.9%), and “Spoofing” (39.3%). In terms of protection from these attacks, restaurant IT managers reported that the most used protection tool is antivirus software (86.2%), hardware firewall (79.3%) and physical security (75.9%). The least used network security tools are honeypots (7.7%) and biometrics (14.8%). The study concludes with suggestions for restaurants as to how to improve network security as well as provide recommendations for future research in this area.

A queueing analysis for the denial of service (DoS) attacks in computer networks

In most network security analysis, researchers mainly focus on qualitative studies on security schemes and possible attacks, and there are few papers on quantitative analysis in the current literature. In this paper, we propose one queueing model for the evaluation of the denial of service (DoS) attacks in computer networks. The network under DoS attacks is characterized by a two-dimensional embedded Markov chain model. With this model, we can develop a memory-efficient algorithm for finding the stationary probability distribution which can be used to find other interesting performance metrics such as the connection loss probability and buffer occupancy percentages of half-open connections for regular traffic and attack traffic. Different from previous works in the literature, this paper gives a more general analytical approach to the study of security measures of a computer network under DoS attacks. We hope that our approach opens a new avenue to the quantitative evaluation of more complicated security schemes in computer networks.

To Be Secure or Not to Be

ABSTRACT A survey of 234 hotel information technology managers was conducted to find out security practices for hotel networks and prevention techniques. Twenty percent of the respondents had a computer network attack within the last 12 months. The size of the hotel seems to be positively correlated with the number of attacks observed within the last 12 months. Regarding attack types, virus attack (15.4%) was reported most frequently, followed by “Denial of Service” (7.7%). The most basic tools/techniques such as access control and anti-virus software are used by many hotels internally. However, there are several important network security tools/techniques such as vulnerability assessment scan or biometrics that are not used by hotels.

A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods

Large-scale computer network attacks in their final stages can readily be identified by observing very abrupt changes in the network traffic. In the early stage of an attack, however, these changes are hard to detect and difficult to distinguish from usual traffic fluctuations. Rapid response, a minimal false-alarm rate, and the capability to detect a wide spectrum of attacks are the crucial features of intrusion detection systems. In this paper, we develop efficient adaptive sequential and batch-sequential methods for an early detection of attacks that lead to changes in network traffic, such as denial-of-service attacks, worm-based attacks, port-scanning, and man-in-the-middle attacks. These methods employ a statistical analysis of data from multiple layers of the network protocol to detect very subtle traffic changes. The algorithms are based on change-point detection theory and utilize a thresholding of test statistics to achieve a fixed rate of false alarms while allowing us to detect changes in statistical models as soon as possible. There are three attractive features of the proposed approach. First, the developed algorithms are self-learning, which enables them to adapt to various network loads and usage patterns. Secondly, they allow for the detection of attacks with a small average delay for a given false-alarm rate. Thirdly, they are computationally simple and thus can be implemented online. Theoretical frameworks for detection procedures are presented. We also give the results of the experimental study with the use of a network simulator testbed as well as real-life testing for TCP SYN flooding attacks

An application of principal component analysis to the detection and visualization of computer network attacks

Network traffic data collected for intrusion analysis is typically high-dimensional making it difficult to both analyze and visualize. Principal Component Analysis is used to reduce the dimensionality of the feature vectors extracted from the data to enable simpler analysis and visualization of the traffic. Principal Component Analysis is applied to selected network attacks from theDarpa 1998 intrusion detection data sets namely: Denial-of-Service and Network Probe attacks. A method for identifying an attack based on the generated statistics is proposed. Visualization of network activity and possible intrusions is achieved using Bi-plots, which provides a summary of the statistics.

Detection of intrusions in information systems by sequential change-point methods

Sequential multi-chart detection procedures for detecting changes in multichannel sensor systems are developed. In the case of complete information on pre-change and post-change distributions, the detection algorithm represents a likelihood ratio-based multichannel generalization of Page’s cumulative sum (CUSUM) test that is applied to general stochastic models that may include correlated and nonstationary observations. There are many potential application areas where it is necessary to consider multichannel generalizations and general statistical models. In this paper our main motivation for doing so is network security: rapid anomaly detection for an early detection of attacks in computer networks that lead to changes in network traffic. Moreover, this kind of application encourages the development of a nonparametric multichannel detection test that does not use exact pre-change (legitimate) and post-change (attack) traffic models. The proposed nonparametric method can be effectively applied to detect a wide variety of attacks such as denial-of-service attacks, worm-based attacks, port-scanning, and man-in-the-middle attacks. In addition, we propose a multichannel CUSUM procedure that is based on binary quantized data; this procedure turns out to be more efficient than the previous two algorithms in certain scenarios. All proposed detection algorithms are based on the change-point detection theory. They utilize the thresholding of test statistics to achieve a fixed rate of false alarms, while allowing changes in statistical models to be detected “as soon as possible”. Theoretical frameworks for the performance analysis of detection procedures, as well as results of Monte Carlo simulations for a Poisson example and results of detecting real flooding attacks, are presented.

A Framework for the Analysis of Denial of Service Attacks

We develop a framework for the analysis of Denial of Service (DoS) attacks in computer networks. In this framework, we identify the components and resources that collectively and in time, construct a service that may become unavailable due to the unavailability of those resources as a result of a DoS. We also construct the notion of service resilience pre-ordering to compare the effectiveness of solutions proposed to improve a system’s resilience against DoS. We apply our framework and methods to some cases, and show their usefulness and applicability in practice.

Wired warfare: Computer network attack and jus in bello

La guerre de l'information s'annonce comme le nouvel outil revolutionnaire qui sera utilise pour se battre dans les conflits armes. Une attaque contre les reseaux informatiques (Computer Network Attack, CNA) designe toute operation visant a perturber, refuser, degrader ou detruire l'information residente dans les ordinateurs ou les reseaux informatiques. Dans les conflits armes internationaux, les ramifications de ce genre d'attaque peuvent se reveler considerables. Cet article examine le recours aux attaques contre les reseaux informatiques dans les conflits armes internationaux. Il analyse d'abord l'applicabilite du droit international humanitaire a ces attaques, puis les effets juridiques de cette branche du droit sur le recours a telles attaques comme moyens de combat. Certains estiment que, bien qu'il n'y ait pas en droit international humanitaire de regles explicites relatives aux attaques contre les reseaux informatiques et que ces attaques n'aient pas un caractere cinetique (en d'autres termes, ces attaques ne sont pas des attaques «armees»), le droit humanitaire s'applique neanmoins si l'on tient compte de ses objectifs sous-jacents, a savoir proteger les personnes qui ne participent pas directement aux hostilites et leurs biens. Quand les attaques contre les reseaux informatiques ont pour but ou risquent de mettre en danger des personnes ou des biens proteges, le droit humanitaire devient applicable, et ces attaques relevent du jus in bello. En analysant la liceite du recours aux attaques contre les reseaux informatiques sous l'angle du droit international humanitaire, l'auteur met non seulement en lumiere les questions juridiques fondamentales (et non resolues) relatives a ce type de guerre, mais il souleve aussi des questions essentielles telles que la definition d'un conflit arme et la capacite du droit international humanitaire de reglementer des methodes et moyens de guerre nouveaux et interessants d'un point de vue conceptuel.

The Ethics of Computer Network Attack

Those who really deserve praise are the people who, while human enough to enjoy power, nonetheless pay more attention to justice than they are compelled to do by the situation. Thucydides, Speech of the Athenians [1] have the power, the capability, sitting in my home with my computer and my modem--if I only understood how to do it--to wage war. That is a very different environment than anything that we have experienced in the past. James Adams [2] Today we are on the verge of technological advances that will redefine how we wage war and, in many cases, blur the current line between economic competition and warfare. The technology which holds the most promise, as well as the most unknown danger, is the world of computer networks--cyberspace. With the proliferation of computers and ever-increasing computing power available to nearly every private citizen in developed countries, microprocessors have changed the lives of countless millions of people. The ubiquity of computing within business, finance, educational, and military institutions has raised concerns about the security of the data and tools upon which we have become increasingly dependent. [3] Many authors have expressed increasing concerns with our computer security. Some have speculated that an against the United States could disrupt electricity supplies and telephone service, interfere with air traffic control, cause leaks or explosions at chemical plants or refineries, and cause economic damage ranging into billions of dollars. [4] Likewise, other nations and transnational groups may have similar vulnerabilities the United States could exploit. Therefore, some people reason the United States should develop its own capabilities in the realm of computer network attack. In many articles and books, authors highlight the supposed elegance of bringing an enemy to his knees without firing a shot, instead rendering him defenseless and harmless by defeating his information infrastructure via surgical attacks. [5] The weapons of computer network include chipping [6] (inserting malevolent code into hardware during manufacturing), programming back doors to allow external control of a computer, and disseminating computer viruses. On the surface, these weapons appear to be nonlethal in nature, but they may have disruptive or deadly higher-order effects. Technologically capable nations are, perhaps by necessity, contemplating the addition of computer to their arsenals. During the Kosovo intervention, the United States attempted limited electronic attacks on Serbian computers containing banking records of Serbian leaders. [7] The United States is not alone, however. In 1995, the National Security Agency and Department of Energy estimated that more than 120 nations already had some sort of computer capability. [8] The People's Republic of China reportedly is studying numerous types of dirty war--asymmetric attack in today's military parlance --which include using computer viruses to pitch China's technologically advanced enemies into political and economic crisis. [9] The potential for such a crisis makes the application of computer network a very different sort of combat power than the kinetic weapons it may someday supplement or replace. Like kinetic weapons, a computer network can destroy both military and civilian targets. Unlike kinetic weapons, however, a computer network can reach across the world at the speed of light, invisibly transiting many international borders en route to its target. Like chemical and biological weapons, cyber weapons can target large masses of people in both military and civilian communities. Unlike biological and chemical weapons, however, they affect humans indirectly rather than directly. Cyber weapons thus share some similarities with weapons of yesterday, yet they occupy a completely new niche by their nature. …

Cyberattacks…US goes on the offensive

The US Defense Department said it is moving forward to make computer network attacks part of the military arsenal and will assign the mission of conducting computer network attacks to the US Space Command later this year on October 1st.

Computer Network Attacks by Terrorists: Some Legal Dimensions

Computer Network Attacks by Terrorists: Some Legal Dimensions