Kill Chain Model Research Articles

Representation and evaluation of the closed-loop time of the kill chain under uncertainties}{Representation and evaluation of the closed-loop time of the kill chain under uncertainties

The kill chain is important for forming system-combat capabilities based on an information system and improving combat effectiveness. The closed-loop time is one of the most important indexes characterizing the efficiency of the kill chain. The combat process has considerable uncertainties; the expression of the uncertainties and evaluation of the efficiency of the kill chain provide basic groundwork in kill chain research. In this paper, we construct three types of kill chain models based on the typical combat system and process, which are chain, network without loop, and network with loop. We then introduce three different closed-loop time calculations for the three models based on stochastic methods to express the uncertainties in the completion time, completion situation, and transformation situation of the activities in the kill chain. The results of this paper provide a theoretical basis and technical support with respect to problems in modeling, evaluating the effectiveness, and constructing the kill chain.

Using Deceptive Information in Computer Security Defenses

In this paper the authors present a novel taxonomy of methods and techniques that can be used to protect digital information. The authors discuss how information has been protected and show how we can structure our methods to achieve better results. They explore the relationships among these protection techniques grouped into four categories: denial and isolation, degradation and obfuscation, negative information and deception and adversary attribution and counter-operations. The authors discuss how can they be applied at different scales within organizations. They map these protection techniques against the cyber kill-chain model and discuss some findings. Moreover, they identify the use of deceit as a useful protection technique that can significantly enhance the security of computer systems. They posit how the well-known Kerckhoff's principle has been misinterpreted to drive the security community away from deception-based mechanisms. The authors examine advantages these techniques can have when protecting our information in addition to traditional methods of denial and hardening. They show that by intelligently introducing deceit in information systems, the authors not only lead attackers astray, but also give organizations the ability to detect leakage; create doubt and uncertainty in leaked data; add risk at the adversaries' side to using the leaked information; and significantly enhance our abilities to attribute adversaries. They discuss how to overcome some of the challenges that hinder the adoption of deception-based techniques and present some recent work, their own contribution, and some promising directions for future research.