Proceedings of the 14th Cyber Security Experimentation and Test Workshop最新文献

Towards Labeling On-Demand IoT Traffic 面向按需标注物联网流量

Proceedings of the 14th Cyber Security Experimentation and Test Workshop Pub Date : 2021-08-09 DOI: 10.1145/3474718.3474727

Daniel Campos, T. OConnor

引用次数: 3

Proceedings of the 14th Cyber Security Experimentation and Test Workshop 第十四届网络安全实验与测试研讨会论文集

Proceedings of the 14th Cyber Security Experimentation and Test Workshop Pub Date : 2021-08-09 DOI: 10.1145/3474718

引用次数: 0

D2U: Data Driven User Emulation for the Enhancement of Cyber Testing, Training, and Data Set Generation D2U:用于增强网络测试、培训和数据集生成的数据驱动用户仿真

Proceedings of the 14th Cyber Security Experimentation and Test Workshop Pub Date : 2021-08-09 DOI: 10.1145/3474718.3475718

Sean Oesch, R. A. Bridges, Miki E. Verma, Brian Weber, O. Diallo

{"title":"D2U: Data Driven User Emulation for the Enhancement of Cyber Testing, Training, and Data Set Generation","authors":"Sean Oesch, R. A. Bridges, Miki E. Verma, Brian Weber, O. Diallo","doi":"10.1145/3474718.3475718","DOIUrl":"https://doi.org/10.1145/3474718.3475718","url":null,"abstract":"Whether testing intrusion detection systems, conducting training exercises, or creating data sets to be used by the broader cybersecurity community, realistic user behavior is a critical component of a cyber range. Existing methods either rely on network level data or replay recorded user actions to approximate real users in a network. Our work produces generative models trained on actual user data (sequences of application usage) collected from endpoints. Once trained to the user’s behavioral data, these models can generate novel sequences of actions from the same distribution as the training data. These sequences of actions are then fed to our custom software via configuration files, which replicate those behaviors on end devices. Notably, our models are platform agnostic and could generate behavior data for any emulation software package. In this paper we present our model generation process, software architecture, and an investigation of the fidelity of our models. Specifically, we consider two different representations of the behavioral sequences, on which three standard generative models for sequential data—Markov Chain, Hidden Markov Model, and Random Surfer—are employed. Additionally, we examine adding a latent variable to faithfully capture time-of-day trends. Best results are observed when sampling a unique next behavior (regardless of the specific sequential model used) and the duration to take the behavior, paired with the temporal latent variable. Our software is currently deployed in a cyber range to help evaluate the efficacy of defensive cyber technologies, and we suggest additional ways that the cyber community as a whole can benefit from more realistic user behavior emulation.","PeriodicalId":128435,"journal":{"name":"Proceedings of the 14th Cyber Security Experimentation and Test Workshop","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116455199","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Case Studies in Experiment Design on a minimega Based Network Emulation Testbed 微型网络仿真试验台实验设计实例研究

Proceedings of the 14th Cyber Security Experimentation and Test Workshop Pub Date : 2021-08-09 DOI: 10.1145/3474718.3474730

Brian Kocoloski, Alefiya Hussain, Matthew Troglia, Calvin Ardi, Steven Cheng, D. DeAngelis, Christopher Symonds, Michael Collins, R. Goodfellow, S. Schwab

引用次数: 1

Getting to the HART of the Matter: An Evaluation of Real-World Safety System OT/IT Interfaces, Attacks, and Countermeasures 达到问题的核心:对现实世界安全系统OT/IT接口、攻击和对策的评估

Proceedings of the 14th Cyber Security Experimentation and Test Workshop Pub Date : 2021-08-09 DOI: 10.1145/3474718.3474726

L. Tinnel, Michael E. Cochrane

{"title":"Getting to the HART of the Matter: An Evaluation of Real-World Safety System OT/IT Interfaces, Attacks, and Countermeasures","authors":"L. Tinnel, Michael E. Cochrane","doi":"10.1145/3474718.3474726","DOIUrl":"https://doi.org/10.1145/3474718.3474726","url":null,"abstract":"This paper discusses our experience evaluating attack paths and security controls in commonly used, real-world ICS safety system architectures. Specifically, we sought to determine if an SIS-mediated architecture could provide better protection against unauthorized and malicious safety instrument configuration changes than could a MUX-mediated architecture. An assessment question-driven approach was layered on top of standard penetration assessment methods. Test cases were planned around the questions and a sample set of vendor products typically used in the oil and gas sector. Four systems were composed from different product subsets and were assessed using the test cases. We analyzed results from the four assessments to illuminate issues that existed regardless of system composition. Analysis revealed recurring vulnerabilities that exist in all safety systems due to issues in the design of safety instruments and the HART protocol. We found that device-native hardware write-protections provide the best defense, followed by SIS write protections. We concluded that, when using SIS security controls, an SIS-mediated system can protect against unauthorized device reconfigurations better than can a MUX-based system. When SIS security controls are not used, there is no added security benefit. We present lessons learned for ICS stakeholders and for people who are interested in conducting this kind of evaluation.","PeriodicalId":128435,"journal":{"name":"Proceedings of the 14th Cyber Security Experimentation and Test Workshop","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132145434","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Through the Spyglass: Towards IoT Companion App Man-in-the-Middle Attacks 通过望远镜:对物联网配套应用程序的中间人攻击

Proceedings of the 14th Cyber Security Experimentation and Test Workshop Pub Date : 2021-08-09 DOI: 10.1145/3474718.3474729

T. OConnor, D. Jessee, Daniel Campos

引用次数: 8

Combat Security Alert Fatigue with AI-Assisted Techniques 利用人工智能辅助技术消除安全警报疲劳

Proceedings of the 14th Cyber Security Experimentation and Test Workshop Pub Date : 2021-08-09 DOI: 10.1145/3474718.3474723

Tao Ban, Samuel Ndichu, Takeshi Takahashi, D. Inoue

{"title":"Combat Security Alert Fatigue with AI-Assisted Techniques","authors":"Tao Ban, Samuel Ndichu, Takeshi Takahashi, D. Inoue","doi":"10.1145/3474718.3474723","DOIUrl":"https://doi.org/10.1145/3474718.3474723","url":null,"abstract":"The main challenge for security information and event management (SIEM) is to find critical security incidents among a huge number of false alerts generated from separate security products. To address the alert fatigue problem that is common for security experts operating the SIEM, we propose a new alert screening scheme that leverages artificial intelligence (AI)-assisted tools to distinguish actual threats from false alarms without investigating every alert. The proposed scheme incorporates carefully chosen learning algorithms and newly designed visualization tools to facilitate speedy alert analysis and incident response. The proposed scheme is evaluated on an alert dataset collected in the security operation center of an enterprise. With a recall rate of 99.598% for highly critical alerts and a false positive rate of 0.001% reported, the proposed scheme demonstrated very promising potential for real world security operations. We believe the proposed scheme is effective in addressing the alert fatigue problem, and therefore paves the way for a consolidated security solution for network security at the enterprise level.","PeriodicalId":128435,"journal":{"name":"Proceedings of the 14th Cyber Security Experimentation and Test Workshop","volume":"78 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-08-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128397960","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 18