Automating Cyber- Defense Management By: Zach Archer COSC 316

Road Map Introduction State the Problem Approach Key Components Current Achievements Related Work Conclusion Questions

Introduction BBN Technologies New step in security Survivability Architecture What do we mean to do  Automating Cyber-Defense Management is just taking the human experts out of the role of “intelligent control loop”.  Outermost control loop.

Stating the Problem Survivability architectures combine three basic types of defensive capability  Protection  Detection  Adaptive Reaction Lots of information Architecture allows for certain assumption  What needs fixed  Actions that may be applicable

Approach To encode knowledge to rules and constraints Create a process that uses the knowledge representation Then use the process to detect and resolve issues that may arise in a system.

Key Elements Knowledge Representation (KR) Event Interpretation (EI) Response Selection (RS) Claim Selection (CS)

Knowledge Representation (KR) Knowledge of human experts Four types of knowledge  What machine is of what OS, network it is on, what services it hosts, and what is connected to or depend upon any given host  Symptomatic knowledge States of the system Reports from the system Classification of possible vulnerabilities  What response options are available  Whether the response will be effective

Event Interpretation (EI) Constructs a constraint network from the alerts 4 types of hypotheses  Dead  Corrupt  Flooded  Known issues This hypotheses is known issues that can arise within the system

Response Selection (RS) Uses responses to maintain operational capabilities 6 Types of high level responses  Refresh  Reset  Ping  Quarantine  Isolate  Degrade Picks out the sequence of response execution  That will be most effective

Claims Selection (CS) Is responsible for selecting a subset of hypotheses  Looking at metadata as proof status  This also has two sections of hypotheses  Proven  Accepted set

Putting it all together

Main idea is to have the CS as a controller that monitors all the decisions that are being made by the other sections Using the checks that are in all the sections and the CS monitoring all work. We can now have the system create a plan of attack Then a plan of attack is then created and processed through checks within the RS to make sure the response to the attack will maintain a working system state

Current Achievements Implemented a simulation environment  50 hosts  60 NICS  Multiple routers and switches  12 application level protocols

Related Work Cisco's Self-Defending Network  One key difference is the focus of without user involvement.

Conclusion The paper concludes that work is currently ongoing Learning more from past successes and failures Success at this level will be a stepping stone

Why Do This Faster response time Expert managers for every system No corrupted humans Stronger more reliable system Less chance for spread

Why Not Do This No expert Machine can have bugs Some decisions may not be made Error reports may be corrupted

THANK YOU Any Questions????

References Partha Pal, Franklin Webber, Michael Atighetchi, Paul Rubel, Paul Benjamin. Automating Cyber Defense Management. Second International Workshop on Recent Advances in Intrusion Tolerant Systems at EuroSys 2008, Glasgow, UK, Mar 31- Apr 4, 2008.