Extending Attack Graphs to Represent Cyber-Attacks in Communication Protocols and Modern IT Networks

We describe some of the issues in the design of a new packet switched network protocol. Adaptation to various network technologies along the dimensions of speed, error model, robustness, etc., is a goal for this new protocol. We look at the adaption in size of the packet header to the speed and robustness of the underlying network to allow efficient communication on low-speed wireless networks, for example. We also explore issues in resource reservation and multicast for real-time multimedia, the notion of a network “flow”, a hybrid of datagrams and virtual circuits, and suggest common solutions for both mobile and multicast routing. The authors are engaged in the design of a network protocol, NP++, whose goal is flexibility over a wide dynamic range of speeds and varying kinds of hardware switching elements.

Most IoT systems involve IoT devices, communication protocols, remote cloud, IoT applications, mobile apps, and the physical environment. However, existing IoT security analyses only focus on a subset of all the essential components, such as device firmware or communication protocols, and ignore IoT systems' interactive nature, resulting in limited attack detection capabilities. In this work, we propose Iota, a logic programming-based framework to perform system-level security analysis for IoT systems. Iota generates attack graphs for IoT systems, showing all of the system resources that can be compromised and enumerating potential attack traces. In building Iota, we design novel techniques to scan IoT systems for individual vulnerabilities and further create generic exploit models for IoT vulnerabilities. We also identify and model physical dependencies between different devices as they are unique to IoT systems and are employed by adversaries to launch complicated attacks. In addition, we utilize NLP techniques to extract IoT app semantics based on app descriptions. Iota automatically translates vulnerabilities, exploits, and device dependencies to Prolog clauses and invokes MulVAL to construct attack graphs. To evaluate vulnerabilities' system-wide impact, we propose two metrics based on the attack graph, which provide guidance on fortifying IoT systems. Evaluation on 127 IoT CVEs (Common Vulnerabilities and Exposures) shows that IOTA's exploit modeling module achieves over 80% accuracy in predicting vulnerabilities' preconditions and effects. We apply Iota to 37 synthetic smart home IoT systems based on real-world IoT apps and devices. Experimental results show that our framework is effective and highly efficient. Among 27 shortest attack traces revealed by the attack graphs, 62.8% are not anticipated by the system administrator. It only takes 1.2 seconds to generate and analyze the attack graph for an IoT system consisting of 50 devices.

Denial of Service (DoS) or Distributed Denial of Service (DDoS) is a powerful attack which prevents the system from providing services to its legitimate users. Several approaches exist to filter network-level attacks, but application-level attacks are harder to detect at the firewall. Filtering at application level can be computationally expensive and difficult to scale, while still creating bogus positives that block legitimate users. In this paper, authors show application layer DoS attack for SIP server using some open source DoS attack tools and also suggest a mechanism that can protect a given SIP server from application-level DoS attacks especially the attacks targeting the resources including CPU, sockets, memory of the victim server. In this paper author’s attempt to illustrate application layer distributed denial of Service (DDoS) attack on SIP Server such as SIP flooding attack, real time transport (RTP) flooding attack using open source DDoS attack tools. We propose a new DDoS defence mechanism that protects SIP servers from application-level DDoS attacks based on the two methodologies: IPtables and fail2ban detection. The attack flow detection mechanism detects attach flows based on the symptom or stress at the server, since it is getting more difficult to identify bad flows only based on the incoming traffic patterns. A popular software known as Wireshark which is a network protocol analyzer is used to capture the packets during DoS attack from the victim server Ethernet interface to detect the attacking host IP address and analysis the types of attack. We evaluate the performance of the proposed scheme via experiment

As an emerging and pragmatic network management paradigm, Software-Defined Networking (SDN) provides a promising solution to develop a flexible, vendor-neutral Naval Supervisory Control and Data Acquisition (SCADA) network by using open network protocols. Since SCADA networks are intrinsically vulnerable due to their interconnected and automated nature, Denial of Service (DoS) attack to the SDN-enabled SCADA network is studied in this paper. DoS attack is launched in the SDN network by using Mininet virtualization, Wireshark, and hping3 techniques. The idea is to understand how an attack occurs and uncover the impact of DoS attack to the SDN-enabled SCADA network, thus the corresponding defense strategies can be developed for the DoS attack. Extensive tests on Mininet have demonstrated the DoS attack results for studying the impact of DoS attack. Therefore, the defense strategies can be developed in the future study to enhance the security of the naval SCADA networks.

Quantum computing is a new technological discovery that has the potential to transform industries based on high computational capabilities. This work explores how quantum computing will be integrated into AI applications and what impacts it will have on IT networks. A review of the recent literature shows that IT networks need to be upgraded to receive quantum-enhanced AI algorithms, as they require more computation power and faster real-time processing. It covers three major topics: the enabling of quantum AI applications, the role of QRC (quantum reservoir computing) in IT networking, and the challenges concerning the protocols of quantum communication, such as QKD (quantum key distribution). Network architectures of today’s state of the art will have to evolve toward enabling quantum-enabled AI, primarily regarding processing speed and interaction between the quantum and classical systems. This work, therefore, wishes to explain how such technological advances could influence AI applications and tune IT networks. We discuss the following questions: How can IT networks support the exploitation of quantum computing for AI applications? What effects do the dynamics and symmetries of quantum reservoir computing have on IT networks? Which IT networks can adapt to the challenges introduced by quantum computing technologies? The scope and depth of contributions reviewed in the articles together suggest huge potential for quantum computing in optimizing machine learning processes and IT networks with improved data handling and network management. At the same time, these ambitions are underlined by scaling concerns related to quantum hardware and qubit stabilization, and finally, the relative easiness with which quantum-classical computing is retrofitted into existing IT infrastructures. The findings suggest that hybrid quantum-classical systems will be essential in future IT infrastructure; efficiency and scalability will have to balance with security concerns in quantum computing environments.

At present, control system security efforts are primarily technical and reactive in nature. What has been overlooked is the need for proactive efforts, focused on the IT security research community from which new threats might emerge. Evaluating cutting edge IT security research and how it is evolving can provide defenders with valuable information regarding what new threats and tools they can anticipate in the future. Only known attack methodologies can be blocked, and there is a gap between what is known to the general security community and what is being done by cutting edge researchers --both those trying to protect systems and those trying to compromise them. The best security researchers communicate with others in their field; they know what cutting edge research is being done; what software can be penetrated via this research; and what new attack techniques and methodologies are being circulated in the black hat community. Standardization of control system applications, operating systems, and networking protocols is occurring at a rapid rate, following a path similar to the standardization of modern IT networks. Many attack methodologies used on IT systems can be ported over to the control system environment with little difficulty. It is extremely important to take advantage of the lag time between new research, its use on traditional IT networks, and the time it takes to port the research over for use on a control system network. Analyzing nascent trends in IT security and determining their applicability to control system networks provides significant information regarding defense mechanisms needed to secure critical infrastructure more effectively. This work provides the critical infrastructure community with a better understanding of how new attacks might be launched, what layers of defense will be needed to deter them, how the attacks could be detected, and how their impact could be limited.

The use of Unmanned Aerial Vehicles (UAV) in every field is increasing rapidly. In order for UAVs to perform their duties correctly, they must be able to maintain continuous communication with ground stations. The use of WiFi wireless communication protocol has increased due to its high bandwidth. One of the most important threats that can threaten this type of communication is Denial of Service (DoS) attacks. In the event of such an attack, the UAV becomes inaccessible and may crash. Especially when the open port number is known, it becomes much easier to perform attacks that consume the resources of the drone. In this study, a mechanism is proposed to eliminate or at least mitigate the attack risk. This mechanism enables UAVs using wireless communication (WiFi) to communicate using TCP over UDP using middleware. In addition, by periodically changing the UDP open ports with a secret port number sequence known to both parties, it prevents the attacker from using the open port for a long time and renders the attack ineffective. In this study, the effects of the port hopping method on UAVs are evaluated. Test results on real systems shows that the proposed system makes the communication system of UAVs more resistant to DoS attacks by 91.2%.

In this talk I will discuss some of the lessons I've discovered about network protocol design; how to make protocols self-stabilizing, how to make networks self-configuring, how to provide optional configuration in such a way that misconfiguration does no harm, and how to design within constraints such as backward compatibility and politics. I'll also talk about some of my recent work. It is confusing enough that forwarding is done at both layers 2 and 3. Why am I designing a layer 2 1/2? And having spent most of my life in the world of computer network communication protocol design, I will share my observations about ways in which communication protocols in other areas could be improved.

This article presents a survey of ad hoc networking protocols that have used concepts such as centrality metrics and community formation from the area of social network analysis, which is seen as a network measurement task that deals with structural properties of the network graph. We recognize the synergy among social network analysis and ad hoc networking as a fertile research area that can provide significant advances for the design of network protocols, especially in environments where the communication is opportunistic in nature and therefore cannot be easily or efficiently described as an optimization problem, and other systematic approaches like cross-layer optimization are more difficult to apply.

Power dissipation continues to be a primary design constraint in single and multicore systems. Increasing power consumption not only results in increasing energy costs, but also results in high die temperatures that affect chip reliability, performance, and packaging cost. Energy conservation has been largely considered in the hardware design in general and also in embedded multicore systems’ components, such as CPUs, disks, displays, memories, and so on. Significant additional power savings can be also achieved by incorporating low-power methods into the design of network protocols used for data communication (audio, video, etc.). This chapter investigates in details power reduction techniques at components and the network protocol levels.

Huge networks simulation remains to be a challenge, although various network simulators are in place. In this paper, we demonstrate a Scalable Network Simulator Architecture (SNSA) that brings together the four major areas of networking research: network modeling, simulation, measurement and protocol design. SNSA is a tool for computing scalable design of experiments through components such as a discrete-event simulation engine, default and extensible model designs, and a state of the art XML interface. Developers will be able to design and implement their own protocol designs, network topologies and modeling scenarios. Finally, we provide sample simulation model for Transmission Control Protocol (TCP).

Advanced electronic units inside modern vehicles have enhanced the driving\nexperience, but also introduced a myriad of security problems due to the\ninherent limitations of the internal communication protocol. In the last two\ndecades, a number of security threats have been identified and accordingly,\nsecurity measures have been proposed. While a large body of research on the\nvehicular security domain is focused on exposing vulnerabilities and proposing\ncounter measures, there is an apparent paucity of research aimed at reviewing\nexisting works on automotive security and at extracting insights. This paper\nprovides a systematic review of security threats and countermeasures for the\nubiquitous CAN bus communication protocol. It further exposes the limitations\nof the existing security measures, and discusses a seemingly-overlooked,\nsimple, cost-effective and incrementally deployable solution which can provide\na reasonable defense against a major class of packet injection attacks and many\ndenial of service attacks.\n

New high-performance neural interfacing approaches are demanded for today's Brain-Machine Interfaces (BMIs). In this paper, we present the architecture of a wireless network of implantable microsystems (Brain-ASNET: Brain Area Sensor NETwork). As well, we introduce an energy-efficient ad-hoc network protocol for the desired network, along with a method to overcome issue of variable packet length caused by bit stuffing process in HDLC standard protocol. To implement the idea, architecture and design of a System-on-a-Chip (SoC) is also presented. The SoC can be configured to be used either as a sensor node chip or the network coordinator's RF front-end and network controller. The SoC is designed and laid-out in an IBM 0.13µm CMOS process. The post-layout simulation results show energy efficiency of the designed ad-hoc network protocol and low power dissipation of the SoC. The whole chip, including all functional and peripheral integrated components, consumes 138µW and 412µW, at 1.2V, configured in a synchronized network as a sensor node and the coordinator, respectively.

Robustness has long been a central design goal of the Internet. Much of the initial effort towards robustness focusedon the "fail-stop" model, where node failures are complete and easily detectable by other nodes. The Internet is quite robust against such failures, routinely surviving various catastrophes with only limited outages. This robustness is largely due to the widespread belief in a set of guidelines for critical design decisions such as where to initiate recovery and how to maintain state.However, the Internet remains extremely vulnerable to more arbitrary failures where, through either error or malice, a node issues syntactically correct responses that are not semantically correct. Such failures, some as simple as misconfigured routing state, can seriously undemnine the functioning of the Internet. With the Internet playing such a central role in the global telecommunications infrastructure, this level of vulnerability is no longer acceptable.In this paper we argue that to make the Internet more robust to these kinds of arbitrary failures, we need to change the way we design network protocols. To this end, we propose a set of six design guidelines for improving the network protocol design. These guidelines emerged from a study of past examples of failures, and determining what could have been done to prevent the problem from occurring in the first place. The unifying theme behind the various guidelines is that we need to design protocols more defensively, expecting malicious attack, misimplementation, and misconfiguration at every turn.

Software vulnerabilities in organizational computer networks can be leveraged by an attacker to gain access to sensitive information. As fixing all vulnerabilities requires much effort, it is critical to rank the possible fixes by their importance. Centrality measures over logical attack graphs, or over the network connectivity graph, often provide a scalable method for finding the most critical vulnerabilities.In this paper we suggest an analysis of the planning graph, originating in classical planning, as an alternative for the logical attack graph, to improve the ranking produced by centrality measures. The planning graph also allows us to enumerate the set of possible attack plans, and hence, directly count the number of attacks that use a given vulnerability. We evaluate a set of centrality-based ranking measures over the logical attack graph and the planning graph, showing that metrics computed over the planning graph reduce more rapidly the set of shortest attack plans.