{"title":"The response continuum","authors":"S. Caltagirone, D. Frincke","doi":"10.1109/IAW.2005.1495961","DOIUrl":"https://doi.org/10.1109/IAW.2005.1495961","url":null,"abstract":"Active response is a sequence of actions performed specifically to mitigate a detected threat. Response decisions always follow detection: a decision to take 'no action' remains a response decision. However, active response is a complex subject that has received insufficient formal attention. To facilitate discussion, this paper provides a framework that proposes a common definition, describes the role of response and the major issues surrounding response choices, and finally, provides a model for the process of response. This provides a common starting point for discussion of the full response continuum as an integral part of contemporary computer security.","PeriodicalId":252208,"journal":{"name":"Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop","volume":"76 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130367193","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A framework for system security assessment","authors":"J. Hallberg, A. Hunstad, M. Peterson","doi":"10.1109/IAW.2005.1495956","DOIUrl":"https://doi.org/10.1109/IAW.2005.1495956","url":null,"abstract":"Security assessment is a central ability in the striving for adequate levels of IT security in information systems and networks. In this paper, the issue of system-wide IT security assessment is addressed. The results include a framework for IT security assessment addressing the need to include the influence of system structure in assessments. The purpose of the framework is twofold, to support the development of system security assessment methods and to enable the categorization of existing methods. Moreover, as an example of a possible approach to system security assessment, the CAESAR method is presented. CAESAR enables the calculation of scalar overall system security values as well as system-dependent security values for technical system entities.","PeriodicalId":252208,"journal":{"name":"Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop","volume":"144 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132055351","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Taeshik Shon, Yongdae Kim, Cheolwon Lee, Jongsub Moon
{"title":"A machine learning framework for network anomaly detection using SVM and GA","authors":"Taeshik Shon, Yongdae Kim, Cheolwon Lee, Jongsub Moon","doi":"10.1109/IAW.2005.1495950","DOIUrl":"https://doi.org/10.1109/IAW.2005.1495950","url":null,"abstract":"In today's world of computer security, Internet attacks such as Dos/DDos, worms, and spyware continue to evolve as detection techniques improve. It is not easy, however, to distinguish such new attacks using only knowledge of pre-existing attacks. In this paper the authors focused on machine learning techniques for detecting attacks from Internet anomalies. The machine learning framework consists of two major components: genetic algorithm (GA) for feature selection and support vector machine (SVM) for packet classification. By experiment it is also demonstrated that the proposed framework outperforms currently employed real-world NIDS.","PeriodicalId":252208,"journal":{"name":"Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127478101","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
C. Dunn, J.B. Widby, S. Watson, R.R. Del Rio, D. Fulton
{"title":"Inline network encryptors - enabling Internet protocol tunneling for securing data","authors":"C. Dunn, J.B. Widby, S. Watson, R.R. Del Rio, D. Fulton","doi":"10.1109/IAW.2005.1496002","DOIUrl":"https://doi.org/10.1109/IAW.2005.1496002","url":null,"abstract":"This paper presents an analysis of the different TNEs available to DoD, their capabilities and usability. Also, this paper examines the technical support provided by the Battle Command Battle Laboratory-Gordon (BCBL-G) and the results of the test and evaluation conducted on the general dynamics KG-235 Sectera FNE by the Army Test and Evaluation Command (ATEC). This evaluation includes examining the interoperability between KG-235, KG-175 and the network encryption system (NES). The paper concludes by providing a look at future INEs.","PeriodicalId":252208,"journal":{"name":"Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124363652","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Extending command and control infrastructures to cyber warfare assets","authors":"R. Erbacher","doi":"10.1109/ICSMC.2005.1571660","DOIUrl":"https://doi.org/10.1109/ICSMC.2005.1571660","url":null,"abstract":"The goal of this work is to identify a framework for the integration of cyber command and control within the classical command and control infrastructure. The advent of cyber resources and military capabilities, as well as additional cyber information, requires that command and control infrastructures be updated to incorporate such cyber infrastructures. While much of these infrastructures will operate in isolation from the physical resources, there are needs for cross-over between the two disciplines. Such crossovers require far more flexibility than traditional command and control hierarchies allow.","PeriodicalId":252208,"journal":{"name":"Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114543090","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Thuy D. Nguyen, T. Levin, Cynthia E Irvine, I. Introductlon
{"title":"MYSEA testbed","authors":"Thuy D. Nguyen, T. Levin, Cynthia E Irvine, I. Introductlon","doi":"10.1109/iaw.2005.1495990","DOIUrl":"https://doi.org/10.1109/iaw.2005.1495990","url":null,"abstract":"The technical vision of the emerging net-centric global information grid (GIG) encompasses support for high assurance authentication and multilevel security (MLS) as well as flexible, dynamic security policies. The GIG is intended to address the inefficient exchange of information in current military and intelligence operations that utilize a variety of specialized (so-called \"stove-piped\") systems. In this context, secure information access problems are exacerbated by the need to share information from networks at different classifications (e.g., unclassified, secret, and top secret) and within multinational coalitions in episodic, ad hoc situations. These challenges provide the impetus for the creation of the Monterey security architecture (MYSEA) testbed. The purpose of this testbed is to support research in high assurance multilevel security (MLS) and dynamic security, two areas that are critical to the realization of the GIG's assured information sharing vision. Our experience to date regarding the construction of a test facility for high assurance MLS components and other emerging IA technologies associated with the GIG is summarized here. We have used the GIG as an exemplary framework, but any extended, rapidly evolving enterprise (e.g., government, or commercial) with information assets having a range of value and criticality as well as a range of users with different authorizations will have similar requirements.","PeriodicalId":252208,"journal":{"name":"Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop","volume":"85 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114192165","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}