PivotWall

This talk will cover two topics, namely, modeling and design of Moving Target Defense (MTD), and DIFT games for modeling Advanced Persistent Threats (APTs). We will first present a game-theoretic approach to characterizing the trade-off between resource efficiency and defense effectiveness in decoy- and randomization-based MTD. We will then address the game formulation for APTs. APTs are mounted by intelligent and resourceful adversaries who gain access to a targeted system and gather information over an extended period of time. APTs consist of multiple stages, including initial system compromise, privilege escalation, and data exfiltration, each of which involves strategic interaction between the APT and the targeted system. While this interaction can be viewed as a game, the stealthiness, adaptiveness, and unpredictability of APTs imply that the information structure of the game and the strategies of the APT are not readily available. Our approach to modeling APTs is based on the insight that the persistent nature of APTs creates information flows in the system that can be monitored. One monitoring mechanism is Dynamic Information Flow Tracking (DIFT), which taints and tracks malicious information flows through a system and inspects the flows at designated traps. Since tainting all flows in the system will incur significant memory and storage overhead, efficient tagging policies are needed to maximize the probability of detecting the APT while minimizing resource costs. In this work, we develop a multi-stage stochastic game framework for modeling the interaction between an APT and a DIFT, as well as designing an efficient DIFT-based defense. Our model is grounded on APT data gathered using the Refinable Attack Investigation (RAIN) flow-tracking framework. We present the current state of our formulation, insights that it provides on designing effective defenses against APTs, and directions for future work.

Advanced persistent threats (APTs) consist of multiple attack stages between entry and exit points of the attack. In each stage of the attack, the adversary gathers more privileges, resources, and information about the system and uses this information to gain access to the targeted data of the next stage to reach the final goal. APTs are not only persistent but also stealthy and hence difficult to detect. The persistent nature of APTs, however, creates information flows in the system that can be monitored. One monitoring mechanism is Dynamic Information Flow Tracking (DIFT), which taints and tracks malicious information flows through a system and inspects the flows at designated traps. Since tainting all flows in the system will incur prohibitive resource costs, efficient tagging policies are needed to decide which flows to tag in order to maximize the probability of APT detection while minimizing resource overhead. At present such an analytical model for DIFT for multi-stage APT detection does not exist. In this paper, we propose a game theoretic framework modeling real-time detection of multi-stage APTs via DIFT. We formulate a two-player (APT vs DIFT) nonzero-sum stochastic game with incomplete information to obtain an optimal tagging policy. Our game model consists of a sequence of stages, where each stage of the game corresponds to a stage in the attack. At each stage, the goal of the APT is to reach a particular destination, corresponding to a targeted resource or privilege, while the goal of the defender is to detect the APT. We first derive an efficient algorithm to find locally optimal strategies for both players. We then characterize the best responses of both players and present algorithms to find the best responses. Finally, we validate our results on a real-world attack data set obtained using the Refinable Attack INvestigation (RAIN) framework for a ScreenGrab attack.

This paper analyzes the process of Google Aurora attack, summarizes the typical steps of APT attacks. By analyzing the defects on traditional enterprise security architecture, this paper proposes a new security solution with a central analysis and control module. The module adopts a detection mode based on the storage, and it is divided into storage layer, analysis layer and presentation layer.

The swift advancement of network technologies has created an unprecedented level of connectivity and efficiency in digital systems. This expansion has also led to the rise of advanced network security threats, undermining traditional defensive strategies. This research study examines the dynamics of new network security risks, assessing their core causes, impacts, and the technology improvements necessary for effective countermeasures. This study examines critical concerns including ransomware, advanced persistent threats (APTs), IoT vulnerabilities, and AI-driven cyberattacks, with the objective of offering practical insights and strategic frameworks for enterprises to anticipate the next decade of cyber threats. Furthermore, empirical case studies and examples demonstrate the urgent nature of these concerns, while suggested remedies highlight possibilities for resilience and innovation. Keywords- Network Security, Advanced Persistent Threats, Ransomware, IoT Vulnerabilities, Cybersecurity Strategies, Artificial Intelligence, Cyber Threat Mitigation, Quantum Cryptography

The swift advancement of network technologies has created an unprecedented level of connectivity and efficiency in digital systems. This expansion has also led to the rise of advanced network security threats, undermining traditional defensive strategies. This research study examines the dynamics of new network security risks, assessing their core causes, impacts, and the technology improvements necessary for effective countermeasures. This study examines critical concerns including ransomware, advanced persistent threats (APTs), IoT vulnerabilities, and AI-driven cyberattacks, with the objective of offering practical insights and strategic frameworks for enterprises to anticipate the next decade of cyber threats. Furthermore, empirical case studies and examples demonstrate the urgent nature of these concerns, while suggested remedies highlight possibilities for resilience and innovation. Keywords- Network Security, Advanced Persistent Threats, Ransomware, IoT Vulnerabilities, Cybersecurity Strategies, Artificial Intelligence, Cyber Threat Mitigation, Quantum Cryptography

With the growth of network applications such as 5G and artificial intelligence, network security techniques, i.e., the techniques that detect various attacks (e.g., well-known denial-of service (DDoS) attacks) and prevent production networks (e.g., data center networks) from being attacked, become increasingly essential for network management and have gained great popularity in the networking community. Generally, these techniques are built on proprietary hardware appliances, i.e., middleboxes, or the paradigm that combines both software-defined networking (SDN) and network function virtualization (NFV) to implement security functions. However, the techniques built on middleboxes are proven to be hard-to-manage, costly, and inflexible, thereby making them an out-of-date choice in network security. For the techniques built on SDN and NFV, they virtualize and softwarize security functions on commodity servers, leading to non-trivial performance degradation. Fortunately, the recent emergence of programmable switches brings new opportunities of empowering network security techniques with the characteristics of easy-tomanage, low cost, high flexibility, and Tbps-level performance. In this survey, we focus on this promising trend in network security. More precisely, this survey first presents the preliminaries of programmable switches, which are the primary driver of next-generation network security techniques. Next, we comprehensively review existing techniques built on programmable switches, classify these techniques, and discuss their background, motivation, design, implementation, and limitations case-by-case. Finally, we summarize open issues and future research directions in this promising research topic of network security.

In recent years, advanced persistent threat (APT) attacks have become a significant network security threat due to their concealment and persistence. Correlation analysis of APT groups is vital for understanding the global network security landscape and accurately attributing threats. Current studies on threat attribution rely on experts or advanced technology to identify evidence linking attack incidents to known APT groups. However, there is a lack of research focused on automatically discovering potential correlations between APT groups. This paper proposes a method using attack behavior patterns and rough set theory to quantify APT group relevance. It extracts two types of features from threat intelligence: APT attack objects and behavior features. To address the issues of inconsistency and limitations in threat intelligence, this method uses rough set theory to model APT group behavior and designs a link prediction method to infer correlations among APT groups. Experimental results on publicly available APT analysis reports show a correlation precision of 90.90%. The similarity coefficient accurately reflects the correlation strength, validating the method’s efficacy and accuracy.

Detection of advanced persistent threat using machine-learning correlation analysis

Software Defined Networking (SDN) is quickly becoming a vital technology for the future Internet. SDN provides a worldwide network with the capacity to manage network traffic dynamically. One of the main advantages of SDN over traditional networks is that it provides better network security due to centralised control. However, the flexibility offered by SDN architecture raises several additional network security concerns that must be addressed to improve SDN network security. This study proposes an unsupervised learning method to address attacks in the SDN controller. 7 extracted features from southbound traffic have been used to train KMeans, MeanShift, Density-Based Spatial Clustering of Applications with Noise (DBSCAN), AgglomerativeClustering, Balanced Iterative Reducing and Clustering using Hierarchies (BIRCH), MiniBatchKMeans, Ordering Points To Identify Cluster Structure (OPTICS), and SpectralClustering, which are all well-known unsupervised classifiers. In terms of various well-known performance measuring criteria, such as Silhouette Score (SS), Calinski Harabasz Index (CHI), and Davies Bouldin Index (DBI), BIRCH outperforms all other classifiers.

Software Defined Networking (SDN) is a new network design which brings certain advantageous to the network management compared to the Traditional Network. This research study implements best effort based traditional network. The ability of SDN to support better allocation of bandwidth makes it possible to apply the SDN concept in this research study in order to manage the usage of limited bandwidth in the network. Available network bandwidth must be managed efficiently to ensure a stable network throughput to be delivered to the end user. In SDN, the bandwidth can be managed by utilizing per-port output queues and bandwidth reservation according to the needs of the traffic. This research study assumes the traffics in the network are classified into Sensitive Traffics and Non-Sensitive Traffics. The purpose of this research study is to propose a new model. The model implemented the SDN concept to replace the Traditional Network concept in order to simplify the network bandwidth management while giving priority to the Sensitive Traffics to access the network throughput. The performance of the network throughput of the proposed model with the Traditional Network also has been compared. Preliminary results show the sensitive traffics successfully achieved a higher throughput compared with the non-sensitive traffic.

Advanced Persistent Threats (APTs) are stealthy, sophisticated, long-term, multi-stage attacks that threaten the security of sensitive information. Dynamic Information Flow Tracking (DIFT) has been proposed as a promising mechanism to detect and prevent various cyber attacks in computer systems. DIFT tracks suspicious information flows in the system and generates security analysis when anomalous behavior is detected. The number of information flows in a system is typically large and the amount of resources (such as memory, processing power and storage) required for analyzing different flows at different system locations varies. Hence, efficient use of resources is essential to maintain an acceptable level of system performance when using DIFT. On the other hand, the quickest detection of APTs is crucial as APTs are persistent and the damage caused to the system is more when the attacker spends more time in the system. We address the problem of detecting APTs and model the trade-off between resource efficiency and quickest detection of APTs. We propose a game model that captures the interaction of APT and a DIFT-based defender as a two-player, multi-stage, zero-sum, Stackelberg semi-Markov game. Our game considers the performance parameters such as false-negatives generated by DIFT and the time required for executing various operations in the system. We propose a two-time scale Q-learning algorithm that converges to a Stackelberg equilibrium under infinite horizon, limiting average payoff criteria. We validate our model and algorithm on a real-word attack dataset obtained using Refinable Attack INvestigation (RAIN) framework.

This article addresses the joint switch and controller placement problem in a hybrid software-defined network (SDN), which is an intermediate step of transforming a traditional backbone network into a pure SDN. For a hybrid SDN, the quality of service (QoS) is a primary concern for ensuring service guarantee of a traditional network, while providing additional benefits of softwarization. In the SDN, the positions of SDN controllers determine the QoS parameters, such as network throughput and flow processing delays. Many existing solutions determine the controller locations to optimize the latency of network links and control plane load. However, there is a need to address the problem considering additional aspects of the hybrid SDN, such as SDN switch placement and incremental upgrades. In this article, we propose a priority-based SDN switch placement approach and an incremental controller placement approach for the hybrid SDN. Simulation results depict that the proposed scheme increases programmable traffic by 9.90% compared to the existing MapFirst scheme when the switch upgrade budget is <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">${\$}$</tex-math></inline-formula> 400 K. The proposed scheme decreases QoS violation by 20.89% compared to the Greedy approach with 0.3 million flows.

Virtual Private LAN Services (VPLS) is an Ethernet based VPN (Virtual Private Network) service which provides protocol independent and high speed multipoint-to-multipoint connectivity. In this article, we discuss the possibility to use emerging networks concepts such as Software Defined Networking (SDN) and Network Function Virtualization (NFV) to improve the performance, flexibility and adaptability of VPLS networks. SDN and NFV based VPLS (SoftVPLS) architectures offer new features such as centralized control, network programmability and abstraction to improve the performance, flexibility and automation of traffic, security and network management functions for future VPLS networks.

Information-Centric Networking (ICN) and Software-Defined Networking (SDN) are both new evolving network architectures that are receiving a lot of attention from researchers. ICN is a Future Internet architecture which tries to transform the current Internet architecture from location- and host-centric to content-centric, where obtaining requested data is achieved by the contents’ names regardless of the location of the data. From another angle, SDN is considered a new Internet architecture that moves the control plane management from network devices to a centralized controller. The SDN controller enhances network robustness and improves its scalability, reliability, and flexibility. The integration of ICN and SDN results in massive benefits, where SDN enhances ICN networks’ manageability, controllability, and functionality, and ICN reshapes the SDN design to make it compatible with ICN features and to enhance ICN in terms of network caching, routing, mobility, and security.. In this review paper, a comprehensive survey of the issues and challenges of integrating ICN and SDN is presented. Firstly, ICN’s main characteristics are summarized, and a short comparison between different ICN architectures is completed. Then, the key details of SDN are highlighted. Moreover, the motivation and benefits of merging ICN with SDN are summarized and the state-of-the-art work on merging ICN and SDN is reviewed and classified from several aspects. Finally, several open research issues are highlighted.

This paper is based on the fair analysis on the economic benefits of software defined networking. The paper will explain vividly the concept of software defined networking and its applications together with the economic advantage(s) with respect to both the client perspective and server perspective. In general, SDN provides lower hardware and operational cost in an excessive traffic load of nowadays users. It has tighter security and faster response time with improved management and planning of server controller. SDN when deployed provides better service(s) with respect to lowering cost and of course with better efficiency. Software Defined Network (SDN) is a great revolutionary idea to change IT Industry of which includes cloud computing and many others. The beauty of its architecture is the decoupling of the essential control and data planes from the application layer, thus the underlying infrastructure is abstracted but the network intelligence is logically centralized with state. This architecture gives access to the enterprise to control, program, automate, scale and secure the network according to the business needs, together with securing a safe benefit in competiveness that has risen due to fast advancement in technology. This architecture is even more important to fulfilling the demands of various clients in the current model of networking. The concept of SDN has the potential to change the current networking model. With SDN, for network services, the underlying network infrastructure can be abstracted by the administrators for many applications. In theory, it can be shown that SDN has many benefits over current IT systems but in practical systems, IT companies are reluctant to work with, tend to oppose nor are they ready to deploy SDN. In this paper, the economic benefits are explored and discussed without bias, and it will be shown that new protocol of SDN provides many economic benefits and guidance to IT companies to establish more secure and efficient network.