2009 Cybersecurity Applications & Technology Conference for Homeland Security最新文献_第3页

A High Performance Software Architecture for a Secure Internet Routing PKI 安全Internet路由PKI的高性能软件体系结构

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.17

M. Reynolds, S. Kent

引用次数: 0

Uses and Challenges for Network Datasets 网络数据集的使用和挑战

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.29

J. Heidemann, C. Papdopoulos

引用次数: 24

Insider Threat Detection Using Graph-Based Approaches 使用基于图的方法进行内部威胁检测

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.7

W. Eberle, L. Holder

{"title":"Insider Threat Detection Using Graph-Based Approaches","authors":"W. Eberle, L. Holder","doi":"10.1109/CATCH.2009.7","DOIUrl":"https://doi.org/10.1109/CATCH.2009.7","url":null,"abstract":"Protecting our nation's cyber infrastructure and securing sensitive information are critical challenges for homeland security and require the research, development and deployment of new technologies that can be transitioned into the field for combating cyber security risks. Particular areas of concern are the deliberate and intended actions associated with malicious exploitation, theft or destruction of data, or the compromise of networks, communications or other IT resources, of which the most harmful and difficult to detect threats are those propagated by an insider. However, current efforts to identify unauthorized access to information, such as what is found in document control and management systems, are limited in scope and capabilities. In order to address this issue, this effort involves performing further research and development on the existing graph-based anomaly detection (GBAD) system. GBAD discovers anomalous instances of structural patterns in data that represent entities, relationships and actions. Input to GBAD is a labeled graph in which entities are represented by labeled vertices and relationships or actions are represented by labeled edges between entities. Using the minimum description length (MDL) principle to identify the normative pattern that minimizes the number of bits needed to describe the input graph after being compressed by the pattern, GBAD implements algorithms for identifying the three possible changes to a graph: modifications, insertions and deletions. Each algorithm discovers those substructures that match the closest to the normative pattern without matching exactly.","PeriodicalId":130933,"journal":{"name":"2009 Cybersecurity Applications & Technology Conference for Homeland Security","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-03-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132464467","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 31

A Secure IEC-61850 Toolkit for Utility Automation 用于公用事业自动化的安全IEC-61850工具包

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.39

S. A. Klein

引用次数: 5

The Challenges of Effectively Anonymizing Network Data 有效匿名化网络数据的挑战

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.27

Scott E. Coull, F. Monrose, M. Reiter, Michael Bailey

{"title":"The Challenges of Effectively Anonymizing Network Data","authors":"Scott E. Coull, F. Monrose, M. Reiter, Michael Bailey","doi":"10.1109/CATCH.2009.27","DOIUrl":"https://doi.org/10.1109/CATCH.2009.27","url":null,"abstract":"The uncertainties that currently exist about the efficacy of network data anonymization, from both technical and policy perspectives, leave the research community in a vulnerable position. Even as the field marches forward, it does so with little understanding of the implications of publishing anonymized network data on the privacy of the networks being monitored and the utility to researchers. Without that understanding, data publishers are left to wonder what fields must be anonymized to avoid legal fallout, while researchers question the confidence of results gained from the data. However, the extensive work done on micro- data anonymity provides the network research community with several useful insights about how to effectively apply anonymization to published data. At the same time, prior wisdom cannot be applied directly without first overcoming several challenges, including the development of appropriate privacy and utility definitions for the more complex case of network data. Addressing these challenges is essential, in our view, to ensure the continued, yet responsible, availability of network trace data to support security research.","PeriodicalId":130933,"journal":{"name":"2009 Cybersecurity Applications & Technology Conference for Homeland Security","volume":"314 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-03-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123227576","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 36

FloVis: Flow Visualization System 流动可视化系统

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.18

Teryl Taylor, D. Paterson, J. Glanfield, C. Gates, Stephen Brooks, J. McHugh

{"title":"FloVis: Flow Visualization System","authors":"Teryl Taylor, D. Paterson, J. Glanfield, C. Gates, Stephen Brooks, J. McHugh","doi":"10.1109/CATCH.2009.18","DOIUrl":"https://doi.org/10.1109/CATCH.2009.18","url":null,"abstract":"NetFlow data is routinely captured at the border of many enterprise networks. Although not as rich as full packet–capture data, NetFlow provides a compact record of the interactions between host pairs on either side of the monitored border. Analysis of this data presents a challenge to the security analyst due to its volume. We report preliminary results on the development of a suite of visualization tools that are intended to complement command linetools, such as those from the SiLK Tools, that are currently used by analysts to perform forensic analysis of NetFlow data. The current version of the tool set draws on three visual paradigms: activity diagrams that display various aspects of multiple individual host behaviors as color1 coded time series, connection bundles that show the interactions among hosts and groups of hosts, and the NetBytes viewer that allows detailed examination of the port and volume behaviors of an individual host over a period of time. The system supports drill down for additional detail and pivoting that allows the analyst to examine the relationships among the displays. SiLK data is preprocessed into a relational database to drive the display modes, and the tools can interact with the SiLK system to extract additional data as necessary.","PeriodicalId":130933,"journal":{"name":"2009 Cybersecurity Applications & Technology Conference for Homeland Security","volume":"36 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-03-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133002806","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 67

Correlation and Collaboration in Anomaly Detection 异常检测中的关联与协作

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.34

R. E. Cullingford

引用次数: 5

Towards Fool-Proof Configuration Assessments 迈向万无一失的配置评估

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.37

R. Talpade

引用次数: 0

Quickdraw: Generating Security Log Events for Legacy SCADA and Control System Devices Quickdraw:为传统SCADA和控制系统设备生成安全日志事件

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.33

D. Peterson

引用次数: 34

BGPmon: A Real-Time, Scalable, Extensible Monitoring System 一个实时的，可扩展的，可扩展的监控系统

2009 Cybersecurity Applications & Technology Conference for Homeland Security Pub Date : 2009-03-03 DOI: 10.1109/CATCH.2009.28

He Yan, R. Oliveira, Kevin Burnett, Dave Matthews, Lixia Zhang, D. Massey

{"title":"BGPmon: A Real-Time, Scalable, Extensible Monitoring System","authors":"He Yan, R. Oliveira, Kevin Burnett, Dave Matthews, Lixia Zhang, D. Massey","doi":"10.1109/CATCH.2009.28","DOIUrl":"https://doi.org/10.1109/CATCH.2009.28","url":null,"abstract":"This paper presents a new system, called BGPmon, for monitoring the Border Gateway Protocol (BGP). BGP is the routing protocol for the global Internet. Monitoring BGP is important for both operations and research; a number of public and private BGP monitors are deployed and widely used. These existing monitors typically collect data using a full implementation of a BGP router. In contrast, BGPmon eliminates the unnecessary functions of route selection and data forwarding to focus solely on the monitoring function. BGPmon uses a publish/subscribe overlay network to provide real-time access to vast numbers of peers and clients. All routing events are consolidated into a single XML stream. XML allows us to add additional features such as labeling updates to allow easy identification of useful data by clients. Clients subscribe to BGPmon and receive the XML stream, performing tasks such as archiving, filtering, or real-time data analysis. BGPmon enables scalable real-time monitoring data distribution by allowing monitors to peer with each other and form an overlay network to provide new services and features without modifying the monitors. We illustrate the effectiveness of the BGPmon data using the Cyclops route monitoring system.","PeriodicalId":130933,"journal":{"name":"2009 Cybersecurity Applications & Technology Conference for Homeland Security","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-03-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114231000","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 70