Computer Network Defense Research Articles

Cyber Security and Cyber Defense: Challenges and Building of Cyber Resilience Conceptual Model

Cyber security encompasses a broad range of practices, tools and concepts related closely to those of information and operational technology security. Cyber security is distinctive in its inclusion of the offensive use of information technology to attack adversaries. Use of the term cyber security as a key challenge and a synonym for information security or IT security misleads customers and security practitioners and obscures critical differences between these disciplines. Recommendation for security leaders is that they should use the term cyber security to designate only security practices related to the defensive actions involving or relying upon information technology and/or operational technology environments and systems. Cyber defense is a computer network defense mechanism which includes response to actions and critical infrastructure protection and information assurance for organizations, government entities and other possible networks [3]. In this paper, we investigate how cyber security and cyber defense may lead to cyber resilience with the novel model of cyber resilience designed and presented. Furthermore, within the same model authors investigate actions for cyber security and cyber defense in conditions of increasing challenge of cyber-attacks and the limited capabilities to respond to this threat describing the process of creation, performance and future of EU Cyber Rapid Response Teams (abbr. CRRT) and Mutual Assistance in Cyber Security, introducing novel approach to cyber security and cyber defense at the EU level.

SOC Critical Path: A Defensive Kill Chain Model

Different kill chain models have been defined and analyzed to provide a common sequence of actions followed in offensive cyber operations. These models allow analysts to identify these operations and to understand how they are executed. However, there is a lack of an equivalent model from a defensive point of view: this is, there is no common sequence of actions for the detection of threats and their accurate response. This lack causes not only problems such as unstructured approaches and conceptual errors but, what is most important, inefficiency in the detection and response to threats, as defensive tactics are not well identified. For this reason, in this work we present a defensive kill chain approach where tactics for teams in charge of cyber defense activities are structured and arranged. We introduce the concept of SOC Critical Path (SCP), a novel kill chain model to detect and neutralize threats. SCP is a technology–independent model that provides an arrangement of mandatory steps, in the form of tactics, to be executed by Computer Network Defense teams to detect hostile cyber operations. By adopting this novel model, these teams increase the performance and the effectiveness of their capabilities through a common framework that formalizes the steps to follow for the detection and neutralization of threats. In this way, our work can be used not only to identify detection and response gaps, but also to implement a continuous improvement cycle over time.

Design of Computer Network Security Defense System Based on Big Data

The era of big data promotes the development of computer network, which plays a very important role. Big data can improve people’s life and work enthusiasm with high quality, and further sublimate the standard of the masses. Because of the openness of computer network, it always leads to unnecessary security problems. Therefore, in order to apply the computer network on a large scale and avoid the information leakage caused by the network, this paper proposes the research on the design of computer network security defense system based on the background of big data. First of all, the importance of computer network security is discussed; secondly, the types of network security attacks are discussed, and the computer network security defense system is built by using multi angle and active security defense strategy to maintain the safe operation of the network; then, the risk algorithm is analyzed, and the risk of the whole computer network can be estimated by setting the weight according to the importance of the obtained resources So as to formulate reasonable safety measures. Finally, through the system test, the system has good analysis ability and defense ability, and has outstanding effect in computer network defense.

The investigation on cowrie honeypot logs in establishing rule signature snort

The attack of brute force is still one of the popular attacks used to hack into your account unauthorized by a computer system. Brute force is also the most crucial attack and has a high risk of the system being taken over. Investigating brute force attacks is useful for building strong computer network defense systems. In this study, Snort acts as an intrusion prevention system and Cowrie Honeypot as a tool to investigate anomalous behavior that occurs when a brute force attack happened. The aim of this research is to improve Snort's rule signature performance from brute force attacks by relying on the results of the Cowrie Honeypot log investigation. The results obtained, namely Snort rule signature successfully improved detection capabilities with performance in matching the same packet only requires a short processing time, respectively: 3.5 microsecs in Hydra attacks, 3.8 microsecs in Medusa attacks and 2.3 microsecs in Ncrack attacks.

Research on Key Technology of Computer Network Defense

Computer network technology has been widely used in all walks of life in China under the acceleration of scientific and technological upgrading. In all aspects of social production and people’s lives, we can see the use of the computer network scenarios. A good computer network environment can ensure that citizens’ personal information will not be leaked for no reason and the health of computers themselves. At the same time, there is a trend of diversified development of computer network attack means. So as to improve computer network’s security, we need to explore and analyze the key technologies of computer network defense so as to prepare for the loss or leakage of information and data in computer network. Based on today’s information situation, this paper analyzes today’s network environment, points out the necessity of network defense technology for us, and hopes that China’s information defense technology will be strengthened day by day.

Modeling and simulation analysis of computer network defense

With the continuous development of computer network, its network drawbacks are also increasingly prominent. There are more and more computer network attacks caused by computer network hackers and viruses, which have gradually attracted the attention and attention of government departments, military agencies and national security departments. In order to effectively improve the security of computer network, various computer network attack and defense technologies are constantly updated, and the network attack and defense simulation methods are proposed for the characteristics of network attack and defense technologies Analysis and experiment provide a platform for development. In this context, the computer network modeling and simulation method is born. Applying the modeling and simulation method to the network attack and defense security of the computer can effectively avoid the damage of the computer network. At the same time, this modeling and simulation method also has certain repeatability, flexibility, and does not consume a lot of time, which can effectively ensure the network security of the computer. This paper mainly analyzes this computer modeling and simulation method, in order to promote the computer network security.

Visual displays for cyber network defense

Five computer network Defence displays (one Alphanumeric and four graphical displays: Radial Traffic Analyser, Bar Graph, Cube, and Treemap) were evaluated. Two experiments were conducted using different methodological procedures. Participants responded to questions that were structured to approximate various ways in which analysts might need to consider network traffic. Numerous significant effects were obtained and a fairly clear rank ordering of performance for the four graphical displays was obtained across experiments (from best to worst): Bar Graph, Cube, Radial Traffic Analyser, and Treemap. The results are interpreted from the perspective of ecological interface design: the quality of performance is directly related to the quality of semantic mapping between work domain, display, and human constraints. Factors that may have contributed to the poor performance for the Radial Traffic Analyser and Treemap displays are discussed. General implications for display and interface design are provided. Practitioner summary: Proposed displays for computer network Defence are evaluated; the results are interpreted from the perspective of ecological interface design. The associated design principles are applicable to all analogical graphical displays. Abbreviation: CND: cyber network defence; CSE: cognitive systems engineering; EID: ecological interface design; ICMP: internet control message protocol; IP: internet protocol; RTA: radial traffic analyzer; TCP: transmission control protocol; UDP: user datagram protocol

Elicitation by Critiquing: Applications to Computer Network Defense

With an increasing frequency of data breaches suffered by organizations, computer network defense (CND) is becoming an increasingly important concern. With understanding of how cybersecurity professionals engage in the cognitive aspects of their work, human factors researchers and practitioners can improve tools and training. By optimizing the tools and training network defenders rely on to detect and respond to novel network threats, the cybersecurity workforce will be strengthened. While cognitive task analysis (CTA) is well-positioned to represent the cognitive work of CND, we identify challenges practitioners are likely to encounter in the field. Through a review of published CTAs in CND and other domains, we provide guidance for future CTA efforts in CND. Finally, we present an argument for the use of Elicitation by Critiquing (EBC) and demonstrate its efficacy in mitigating the challenges of applying CTA in CND.

Ecological Interface Design for Computer Network Defense.

A prototype ecological interface for computer network defense (CND) was developed. Concerns about CND run high. Although there is a vast literature on CND, there is some indication that this research is not being translated into operational contexts. Part of the reason may be that CND has historically been treated as a strictly technical problem, rather than as a socio-technical problem. The cognitive systems engineering (CSE)/ecological interface design (EID) framework was used in the analysis and design of the prototype interface. A brief overview of CSE/EID is provided. EID principles of design (i.e., direct perception, direct manipulation and visual momentum) are described and illustrated through concrete examples from the ecological interface. Key features of the ecological interface include (a) a wide variety of alternative visual displays, (b) controls that allow easy, dynamic reconfiguration of these displays, (c) visual highlighting of functionally related information across displays, (d) control mechanisms to selectively filter massive data sets, and (e) the capability for easy expansion. Cyber attacks from a well-known data set are illustrated through screen shots. CND support needs to be developed with a triadic focus (i.e., humans interacting with technology to accomplish work) if it is to be effective. Iterative design and formal evaluation is also required. The discipline of human factors has a long tradition of success on both counts; it is time that HF became fully involved in CND. Direct application in supporting cyber analysts.

Sonification of network traffic flow for monitoring and situational awareness.

Maintaining situational awareness of what is happening within a computer network is challenging, not only because the behaviour happens within machines, but also because data traffic speeds and volumes are beyond human ability to process. Visualisation techniques are widely used to present information about network traffic dynamics. Although they provide operators with an overall view and specific information about particular traffic or attacks on the network, they often still fail to represent the events in an understandable way. Also, because they require visual attention they are not well suited to continuous monitoring scenarios in which network administrators must carry out other tasks. Here we present SoNSTAR (Sonification of Networks for SiTuational AwaReness), a real-time sonification system for monitoring computer networks to support network administrators’ situational awareness. SoNSTAR provides an auditory representation of all the TCP/IP traffic within a network based on the different traffic flows between between network hosts. A user study showed that SoNSTAR raises situational awareness levels by enabling operators to understand network behaviour and with the benefit of lower workload demands (as measured by the NASA TLX method) than visual techniques. SoNSTAR identifies network traffic features by inspecting the status flags of TCP/IP packet headers. Combinations of these features define particular traffic events which are mapped to recorded sounds to generate a soundscape that represents the real-time status of the network traffic environment. The sequence, timing, and loudness of the different sounds allow the network to be monitored and anomalous behaviour to be detected without the need to continuously watch a monitor screen.

Task Interruptions Undermine Cyber Defense

Computer network defense analysts engage a difficult, though critical, task in cyber defense. Anecdotally, these operators complain of frequent task interruptions while they are performing their duties. The goal for the current study was to investigate the effect of a commonly reported interruption, answering email, on accuracy and completion times in a simulated network analyst task. During task trials, participants were interrupted by emails between alert investigations, during alert investigations, or not at all (control). The results indicated that email interruptions increased alert completion times regardless of when they occurred, but interruptions that occurred during an alert investigation also reduced the accuracy of subsequent judgments about alert threat. Overall, the results suggest that task interruptions can potentially undermine cyber defense, and steps should be taken to better quantify and mitigate this threat.

Global and Local Clustering Soft Assignment for Intrusion Detection System: A Comparative Study

Intrusion Detection System (IDS) plays an important role in computer network defence mechanism against malicious objects. The ability of IDS to detect new sophisticated attacks compared to traditional method such as firewall is important to secure the network. Machine Learning algorithm such as unsupervised learning and supervised learning is capable to solve the problem of classification in IDS. To achieve that, KDD Cup 99 dataset is used in experiments. This dataset contains 5 million instances with 5 different categories which are Normal, DOS, U2R, R2L and Probe. With such a large dataset, the learning process consumes a lot of processing times and resources. Clustering is unsupervised learning method that can be used for organizing data by grouping similar features into same group. In literature, many researchers used global clustering approach whereby all input will be combined and clustered to construct a codebook. However, there is an alternative technique namely local clustering approach whereby the input will be split into 5 different categories and clustered independently to construct 5 different codebooks. The main objective of this research is to compare the classification performance between the global and local clustering approaches. For this purpose, the soft assignment approach is used for indexing on KDD input and SVM for classification. In the soft assignment approach, the smallest distance values are used for attack description and RBF kernel for SVM to classify attack. The results show that the global clustering approach outperforms the local clustering approach for binary classification. It gives 83.0% of the KDD Cup 99 dataset. However, the local clustering approach outperforms the global clustering approach on multi-class classification problem. It gives 60.6% of the KDD Cup 99 dataset.

Principles for Interaction Design, Part 3: Spanning the Creativity Gap

The various responsibilities in intelligent systems design--responsibilities to acquire certain knowledge and skills--suggest strongly that effective interaction design is inherently interdisciplinary. As a consequence, gaps in knowledge acquisition and creativity on the part of design teams are bound to emerge as long as responsibilities are abrogated because they are tied to roles (such as cognitive systems engineers versus systems engineers). Communication, collaboration, and knowledge sharing are essential components of success, and a language that cuts across discipline-specific jargon is likely to make the development effort much more effective. This essay describes similarities between two related approaches to interaction design that resonate with each other and share principles: ecological interface design and human-centered computing. These similarities are emphasized by noting similarities between two different interfaces for computer network defense that were independently developed from each approach.

Veils

This paper briefly describes a prototype interface for computer network defense (CND) that has been developed using the cognitive systems engineering (CSE) / ecological interface design (EID) framework. This ecological interface is referred to as VEILS (Versatile Ecological Interface for Lockdown network Security). VEILS supports CND by collecting and integrating network defense information from a variety of sources including intruder detection / protection systems, firewalls, and system logs. VEILS was designed to be consistent with three principles of EID. The innovative displays represent the affordances of the work domain in a manner that is compatible with human visual processes (i.e., direct perception). The capability to specify both information content (different types) and information extent (scope) is supported entirely through intuitive and natural control input including point, click, and drag (i.e., direct manipulation). Finally, interface resources are used to choose alternative viewing perspectives, to highlight functional relationships across displays and to support effective navigation (i.e., visual momentum).

An Approach for Description of Computer Network Defense Scheme and Its Simulation Verification

In order to solve the problem of which the existing defense policy description languages can only describe some aspects of defense, such as protection or detection, but cannot express relationship among actions and to cope with large-scale network attack, we proposed an approach for description of computer network defense scheme and its simulation verification. A computer network defense-oriented scheme description language (CNDSDL) was designed to describe actions of protection (i.e., access control, encryption communication, backup), detection (i.e., intrusion detection, vulnerability detection), analysis (i.e., log auditing), response (i.e., system rebooting, shutdown), recovery (i.e., rebuild, patch making), and relationship among actions (i.e., sequence-and, sequence-or, concurrent-and, concurrent-or, and xor). The Extend Backus-Naur Form (EBNF) of CNDSDL was provided. At last, we provided an implementation mechanism of CNDSDL. A task deadlock detection algorithm was given for the defense scheme. The simulation was completed in simulation platform of GTNetS. Three simulation experiments verified the description capability and effectiveness of CNDSDL. The results of the experiments show that the defense scheme described by CNDSDL can be transformed to detailed technique rules and realize the defense effect of expression.

Human Factors in Cyber Warfare

There has been a dramatic increase in the total number of reported cyber security breaches and attacks in recent years. In response, government, and corporate entities have invested billions of dollars in funding research and development efforts for cyber operations, including computer network defense (CND) and computer network attack (CNA). While cyber operations have become an important national priority over the last decade, the Human Factors community has yet to approach it with critical mass. In its purest form, cyber operations are a complex sociotechnical system that can have effects across all levels of an organization. Due to a consistent interplay between human cognition, technology, and organizational constraints within the environment, the Human Factors community is particularly well-suited to address the problem space. We have assembled a panel of six scientists, technologists, and subject matter experts across multiple specializations in the Human Factors community to help begin this increasingly important discussion. The goal of this panel is to have an open discussion on how we can leverage our specializations and expertise to address the cyber operations landscape as a community.

Tools and Technologies for Professional Offensive Cyber Operations

Since 2008, several countries have published new national cyber security strategies that allow for the possibility of offensive cyber operations. Typically, national strategies call for the establishment of a cyber operations unit capable of computer network defence, exploitation, and, in some nations, attack. The cyber operations unit will be manned by professionals and operate under government authority compliant with national and international law. Our research focuses on offensive cyber operations (i.e. computer network exploitation and attack). The cyber unit must be provided with the right resources, in the form of accommodation, computing and networking infrastructure, tools and technologies, doctrine, and training. We contend that the open literature gives an unbalanced view of what tools and technologies a professional group needs because it emphasizes malware and, to a lesser extent, the delivery media used by cyber criminals. Hence, the purpose of this paper is to identify systematically the tools and technologies needed for professional, offensive cyber operations. A canonical model of the cyber attack process was obtained by rationally reconstructing a set of existing attack process models found in the literature. This canonical model was formalized using Structured Analysis and Design Technique (SADT) notation, in which processes are logically linked by inputs, outputs, controls, and mechanisms. A set of tools and technologies was extracted from the mechanisms. The canonical model and set of tools and technologies have been checked by subject matter experts.

Twelve Principles of Computer Network Operations

A growing number of uniformed military and government entities are practicing new military disciplines of cyber defense, including computer network defense, computer network exploitation, and computer network attack. This paper provides a practitoner's view of principles of operations in this emerging military domain.

Intrusion detections systems – an outmoded network protection model

Intrusion detection systems (IDS) are a common component of computer network defences, but their cost usually outweighs their effectiveness and they give a false sense of security says this article. They attempt to detect malicious activity, but were designed when firewalls were at an earlier stage in their development and use techniques - signatures and noise - which generate resource-consuming false positives. IDS systems are cumbersome, merely reactive, and entail high, often hidden and unnecessary costs for industry, but are often retained because bizarrely they meet auditing requirements. With current technology, the way forward is with intrusion protection pystems (IPS) which are less expensive, preventative and much more sensitive to context and traffic patterns. Intrusion detection systems have become almost a standard element of most modern computer network defence in-depth solutions, but are they really worth their weight in bureaucracy?

Network Science from an IT and US Army Perspective

Network science provides fundamental knowledge of complex networks and how they work. These networks might be natural (biological), technological, or social in nature - or could be combinations of these types. From an information technology perspective, NS can provide a formal, scientific understanding of the social and cognitive aspects of electronic data networks, which for the most part have been only marginally acknowledged and informally addressed. We must consider the following points when seeking to understand NS: Fundamental knowledge about the properties of complex networks is primitive. An important NS goal is prediction of a network's future behavior as a whole as well as of its components individually. An electronic data network is a kind of technological network, of which the Internet provides a pervasive example. Cognition is the mental process of knowing, including aspects such as awareness, perception, reasoning, and judgment. NS researchers often rely on the concept of centrality from graph theory. Various measures of a vertex's centrality within a network's graph representation determine the relative importance of the vertex, which might represent a person in a social network, a node in a technological network, and other points of interest in other kinds of networks. Written from a computer network defense (CND) perspective, this work is meant to raise awareness among information technologists of NS's value to technological networks. It also highlights NS activities by the US Army to form an alliance of government, industrial, and academic institutions in the study of NS and associated grand challenges.