1. Vision: Create proactive and adaptive techniques and methodology in networked systems
Wenjing Lou
Complex Networks and Security Research (CNSR) Lab
Virginia Polytechnic Institute and State University
Panelist Presentation
@ Invitational Workshop on Foundations and Challenges for Proactive and Dynamic Network Defense
Tampa, FL, November 30-December 1, 2017

2. Cybersecurity is a shared responsibility of multiple lines of defense
Authentication, access control, firewalls, cryptographic mechanisms to data
integrity, malware detection, intrusion detection, detection of other malicious activities
Federal Cybersecurity Research and Development Strategic Plan, Feb 2016

3. Cybersecurity is a shared responsibility of multiple lines of defense
The ability to efficiently discourage malicious cyber activities
by measuring and increasing costs to adversaries carrying out such activities, diminishing the spoils, and increasing risks and uncertainty for potential adversaries.
Federal Cybersecurity Research and Development Strategic Plan, Feb 2016

4. Cybersecurity is a shared responsibility of multiple lines of defense
The ability of defenders, defenses, and infrastructure to dynamically adapt to malicious cyber activities, by efficiently reacting to disruption, recovering from damage, maintaining operations while completing restoration, and adjusting to thwart similar future activity
Federal Cybersecurity Research and Development Strategic Plan, Feb 2016

5. Proactive Defense Programs
Moving target defense (MTD)
Instead of having a static system, MTD makes the attack surface dynamic by controlling changes across multiple system dimensions
Increase uncertainty, complexity and cost for attackers
Active cyber defense (ACD)
“an approach to achieving cyber security predicated upon the deployment of measures to detect, analyze, identify and mitigate threats to and from communications systems and networks in real- time, combined with the capability and resources to take proactive or offensive action against threats and threat entities including action in those entities’ home networks. ”
Legal issues of ”hack-back”
Enhanced attribution
identifying the origins of malicious actions
Discourage potential offenders

6. Proactive Defense Programs (Cont.)
Cyber-deception
Deploy decoys, i.e. honeypots and honeynets
Harnessing Autonomy for Countering Cyberadversary Systems (HACCS)
fingerprint Botnet infrastructure
Insert autonomous agent into the gray networks (Exploit n-day vulnerabilities)
Identify and Neutralize Botnet Implants
E.g. Mirai-based whiteworm
Advanced persistent threats (APT)
Transparent Computing (TC)
make opaque computing systems more transparent. 

7. Challenges & Opportunities (Wish List)
Accurate attribution
collaboration with ISPs, federated coordination across organizational boundaries, large-scale research infrastructure support
Measurements, metrics, formal models
Network data analytics, behavioral biometrics techniques
Dynamic assessment
Real-time continuous monitoring, robust situational awareness
Real-time digital forensic analysis methods
Activity prediction, real-time assessment of changes, behaviors, and anomalies, reliably detect malicious cyber activities
AI-based monitoring and detection, security mechanisms capable of learning
Trustworthy information sharing
Privacy, privacy-preserving data analytics
Data provenance, information flow, information usage tracking
Security by design

8. THANK YOU