Visual Analytics for Cyber Defense Decision-Making Anita D’Amico, Ph.D. Secure Decisions division of Applied Visions, Inc. com

2 WHAT DO CYBER DEFENDERS DO? HOW CAN VISUAL ANALYTICS HELP?

3 Incident response team activities (Killcrece, Alberts, CMU studies)  Reactive  Triggered by an event, such as an IDS alert  Examples: Reviewing log files, correlating alerts  Proactive  Prepare, protect and secure for future attacks  Examples: Prediction of upcoming attacks and techniques  Security Quality Management  IT services in support of general information security  Examples: Training, recovery planning, product evaluation Cognitive and decision analyses show: Very little effort on proactive

4 Interesting Activity Raw Data Suspicious Activity Events Incidents Problem Sets Visual analytics can help network defenders transform raw data into meaning

5 Triage analysis  Weed out false positives  Escalate suspicious activity for further analysis Escalation analysis  Analyze data over longer time than Triage  Incorporate multiple data sources (more than Triage) Correlation analysis  Look for patterns and trends  Assess similarity to related incidents – internal & external Incident response  Recommend, implement Courses of Action  Support law enforcement investigation Malware analysis  Reverse-engineer malware  Develop defenses against malware Forensic analysis  Collect and preserve evidence  Support law enforcement investigation Threat analysis  Characterize attackers: identification, modus operandi, motivation, location Vulnerability analysis  Identify and prioritize vulnerabilities  Manage remediation of vulnerabilities Sensor management  Develop signatures, tune sensors  Modify placement of sensors (from 2005 D’Amico & Whitley CTA, and other Secure Decisions decision analyses)

6 Mission impact analysis

7 Escalation, Correlation Comprehension Stages of Situational Awareness (SA) Perception Types of Analysis Triage, Vulnerability Threat, Response Projection Uses of Visualization ORIENT attention REPORT and EXPLAIN what has been observed EXPLORE data (for patterns, anomalies) PREDICT ForensicMalware Visualization should support all stages of SA, types of CND analysis, and uses

8 How do Alan Turner’s VA primitives apply? Perception Types of Analysis Triage, Vulnerability Escalation, Correlation Threat, Response ProjectionComprehension Turner’s Primitives ORIENT CHARACTERIZE QUANTIFY TEST DISCOVER ForensicMalware

9  Old way doesn’t work, and they know it  Never feel totally successful  Hard to estimate the level of effort needed  Not clear when they’re done How do cyber defenders differ from Alan’s users?

10 Coordinated attack to exfiltrate Analysts think about data from perspective of attacker’s goals, methods, and timing. First instance of attacker’s appearance is an important marker. Attack Timeline CND analysts see the world in red and blue; They attend to timing and sequence

11 CYBER SECURITY VISUAL ANALYTICS CHALLENGES

12 Incomplete, inaccurate and ephemeral data Public Networks Missions/ Business Functions Mission -to- Network Mapping Adversaries disappear and re-appear, and can be co-located with friendlies. Wireless networks increase transitory nature of data. Defender Patch Status Dynamic Topology Sensor Location & Status Enterprise

13 Visual analytics is an unfulfilled promise in cyber operations  Failure to transition, to deliver – Lots of R&D; little operational deployment of visual analytics systems  “Lack of information” visualization and analytics – rare  Visual interface to security automation – rare  Process visualization – rare  Visual analytics to augment training – rare  Visual analytics to evaluate tactics – rare

imagine, create, deliver Visual analytics systems  Data import, normalization and aggregation  Non-viz features to reduce “tool time”  Importing, filtering “hot IPs”, authorized devices, and users  Automated report builders  Annotations and personal notes  Diverse media  Workstations, big-board, PDA, in-vehicle displays  Robust, secure, certifiable code base

15 Staying ahead of the adversary  How do we use visual analytics make the cyber defense process more proactive?  How do we enhance information sharing within an organization, and across organizations?  Portable, shareable datasets and visual analytics  Collaborative tools

16 Mapping network assets to organizational missions Need information and visual analytics to discover:  Vulnerabilities of organization’s highest-priority goals  Network assets that must be assured for continuity of mission-critical functions  Organizational impact of an attack, or of a defensive COA

17 Anita D’Amico Secure Decisions division of Applied Visions, Inc. com