Countering Denial of Information Attacks with Network Visualization Gregory Conti

Disclaimer The views expressed in this presentation are those of the author and do not reflect the official policy or position of the United States Military Academy, the Department of the Army, the Department of Defense or the U.S. Government. image:

Denial of Information Attacks: Intentional Attacks that overwhelm the human or otherwise alter their decision making

The Problem of Information Growth The surface WWW contains ~170TB (17xLOC) IM generates five billion messages a day (750GB), or 274 terabytes a year. generates about 400,000 TB/year. P2P file exchange on the Internet is growing rapidly. The largest files exchanged are video files larger than 100 MB, but the most frequently exchanged files contain music (MP3 files).

Applying the Model & Taxonomy…

Defense Taxonomy (Big Picture) Microsoft, AOL, Earthlink and Yahoo file 6 antispam lawsuits (Mar 04) Federal Can Spam Legislation (Jan 04) California Business and Professions Code, prohibits the sending of unsolicited commercial (September 98) First Spam Conference (Jan 03)

Defense Taxonomy (Big Picture) Microsoft, AOL, Earthlink and Yahoo file 6 antispam lawsuits (Mar 04) Federal Can Spam Legislation (Jan 04) California Business and Professions Code, prohibits the sending of unsolicited commercial (September 98) First Spam Conference (Jan 03)

Human Consumer Human Producer Communication Channel Consumer Node RAM Hard Drive CPU Producer Node STM LTM Cognition Consumer Producer RAM Hard Drive CPU STM LTM Cognition Vision Hearing Speech Motor Vision Hearing Speech Motor System Model

Human Consumer Human Producer Communication Channel Consumer Node RAM Hard Drive CPU Producer Node STM LTM Cognition Consumer Producer RAM Hard Drive CPU STM LTM Cognition Vision Hearing Speech Motor Vision Hearing Speech Motor very small text exploit round off algorithm trigger many alerts Example DoI Attacks misleading advertisements spoof browser

Human Consumer Human Producer Communication Channel Consumer Node RAM Hard Drive CPU Producer Node STM LTM Cognition Consumer Producer RAM Hard Drive CPU STM LTM Cognition Vision Hearing Speech Motor Vision Hearing Speech Motor TCP Damping Usable Security Eliza Spam Responder Decompression Bombs Example DoI Defenses Computational Puzzle Solving

Orient Observe Act Decide Scan Subject Line Spam Delete Confirm Deletion Successful Not Spam No Observation No Action Overhead Number of x Time to Decide Overhead Number of Spam x Time to Delete Overhead Number of Spam x Time to Observe Total Overhead = (Number of Spam x (Time to Delete + Time to Observe))+(Number of X (Time to Decide + Time to Scan)) Overhead Number of x Time to Scan

For more information… G. Conti and M. Ahamad; "A Taxonomy and Framework for Countering Denial of Information Attacks;" IEEE Security and Privacy. (to be published) me…

DoI Countermeasures in the Network Security Domain

information visualization is the use of interactive, sensory representations, typically visual, of abstract data to reinforce cognition.

rumint v.51

nmap 3 (RH8) NMapWin 3 (XP) SuperScan 3.0 (XP) SuperScan 4.0 (XP) nmap 3 UDP (RH8) nmap 3.5 (XP) scanline 1.01 (XP) nikto 1.32 (XP)

For more information… G. Conti and K. Abdullah; " Passive Visual Fingerprinting of Network Attack Tools;" ACM Conference on Computer and Communications Security's Workshop on Visualization and Data Mining for Computer Security (VizSEC); October Talk PPT Slides see and for the tool G. Conti; "Network Attack Visualization;" DEFCON 12; August Talk PPT Slides --Classical InfoVis Survey PPT Slides --Security InfoVis Survey PPT Slides

Last year at DEFCON First question… How do we attack it?

Malicious Visualizations…

Pokemon

Visual Information Overload (perception)

Attack Fading (memory) Image:

Motion Induced Blindness (perception)

Optical Illusions (perception)

Crying Wolf… (cognitive/motor) Snot vs. Snort

CDX 2003 Dataset X = Time Y = Destination IP Z = Destination Port Labeling Attack (algorithm)

AutoScale Attack/Force User to Zoom (algorithm)

Precision Attack (algorithm)

Occlusion (visualization design)

Jamming (visualization design)

For more information… G. Conti, M. Ahamad and J. Stasko; "Attacking Information Visualization System Usability: Overloading and Deceiving the Human;" Symposium on Usable Privacy and Security (SOUPS); July (submitted, under review) See also for the tool. me…

rumint v 1.15 beta

Network packets over time Bit 0, Bit 1, Bit 2 Length of packet - 1

rumint 1.15 tool overview network monitoring mode (left), clicking the small pane brings up the detailed analysis view for that visualization.

So what do you think…

Visual exploration of binary objects…

Reverse Engineering IDA Pro Dissassembler and Debugger

Textual vs. Visual Exploration

binaryexplorer.exe

visualexplorer.exe (visual studio) calc.exe (unknown compiler) rumint.exe (visual studio) regedit.exe (unkown compiler) Comparing Executable Binaries (1 bit per pixel) mozillafirebird.exe (unknown compiler) cdex.exe (unknown compiler) apache.exe (unknown compiler) ethereal.exe (unknown compiler)

image.bmp image.zipimage.jpg image.pae (encrypted) Comparing Image Files (1 bit per pixel)

pash.mp3 disguises.mp3the.mp3 Comparing mp3 files (1 bit per pixel)

secvis w/Sven Krasser, Julian Grizzard, Jeff Gribschaw and Henry Owen (Georgia Tech)

Overview of Visualization

Overview and Detail

Routine Honeynet Traffic (baseline)

Compromised Honeypot

Slammer Worm

Constant Bitrate UDP Traffic

Port Sweep

System Performance

For more information… S. Krasser, G. Conti, J. Grizzard, J. Gribschaw and H. Owen; "Real-Time and Forensic Network Data Analysis Using Animated and Coordinated Visualization;" IEEE Information Assurance Workshop (IAW); June (submitted) me…

Demos binary exploration rumint 1.15 secvis

Questions? Image: Gregory Conti

Backup Slides

External IP to Internal Port 6 Oct Oct Oct Oct Nov 04 One Week SnapshotsOne Month