attack attribution

Attack Attribution

Marc Dacier

Sr. Director, Collaborative Advanced Research Dept. (CARD)

Symantec Research Labs

2INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Overview

• Attack Attribution

• One example:

– the TRIAGE method (WOMBAT)

• Challenges, open issues

• Conclusions

3INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Collaborative Advanced Research Dept. C A R D

• CARD is part of Symantec Research Labs, within the CTO office.

• Worldwide team with members located in the USA (Culver City, California and Herndon, Washington DC) as well as in Europe (France and Ireland).

• Specificity: long term exploratory research carried out with external partners from academia and industry

4INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

What we do

• 2 recently completed projects:

– ANTIPHISH – EC funding (finished in June 2009)

– EC-CAM – US (finished in September 2009)

• 3 ongoing funded projects

– WOMBAT (EC)

– VAMPIRE (France)

– NICE (US)

• 2 new projects will start in 2010:

– Minestrone (US)

– VIS-SENSE (EC).

5INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Attack Attribution ….

• … is not about IP traceback

• … is about identifying the root causes of observed attacks by linking them together thanks to common, external, contextual “fingerprints”

6INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Analogy

• Serial killers accomplish a ritual that leaves traces

• Cybercriminals for efficiency reasons automate the various steps of their attack workflow and this leaves traces

7INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Danger

• "One swallow does not a summer make"

Aristotle, Nichomachean Ethics  (384 BC - 322 BC) 

The smiley face killer (?)

8INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Danger (ctd.)

• “When all you have is a hammer, everything looks like a nail”

Maslow's hammer law, The Psychology of Science,

1966

http://xkcd.com/587/

9INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Yes we can (find “things”)This is a worm

These are botnets

These are the threats we

should worry about

This is a stealthy, localised,

recurring event

Bridging the gap between such anecdotal findings and some actionable

knowledge is hard!

10

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Overview

• Attack Attribution

• One example:

– the TRIAGE method (WOMBAT)

• Challenges, open issues

• Conclusions

11

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Foreword

• What is presented here is the result of a joint collaboration between all WOMBAT partners over the last 28 months

(see www.wombat-project.eu for the list of publications and deliverables)

12

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

The WOMBAT approach

Data acquisition

(WP3)

Data enrichment

(WP4)

Threat analysis(WP5)

Stor

age

Anal

ysis

Meta-data

Analysis

New collectionpractices

Crawlers

HoneypotsNew security technologies

Context analysisMalware analysis

New security practices

External feeds Knowledge

13

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Example of a WOMBAT sensor: the SGNET data enrichment framework

Inte

rnet

Inte

rnet

Code Injection informationMalware

SGNET dataset

Models

Clusteringtechniques

13

AV identification

statistics

Generated alerts

Symantec ++

Behavioral Information

14

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Towards automated attack attribution

• Within WOMBAT, we have developed an automated framework that includes the expert knowledge in order to extract meaningful sets to reason about the modus operandi of the malicious actors: the TRIAGE framework

• First application of that approach led to significant contributions in the latest Symantec ISTR Rogue AV report

• Public deliverable D12 is available on line and contains 6 published peer reviewed papers on the topic as well as the rogue AV analysis technical report. – http://wombat-project.eu/WP5/FP7-ICT-216026-

Wombat_WP5_D12_V01_RCA-Technical-survey.pdf

15

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Big Picture (ctd.)

16

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Names vs. IPs maps of Rogue AV sites

17

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Idea behind the attribution method

• Try to connect the dots…

17

18

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

TRIAGE

• TRIAGE1

– = atTRIbution of Attack using Graph-based Event clustering

• Multicriteria clustering method

18

1) Triage (med.): process of prioritizing patients based on the severity of their condition

19

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Successful attack attribution result

19

Time

750 domains registered over a span of 8 months

Email addr. hidden by privacy protection services

20

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Example (ctd.)

20

21

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

So, why is it useful...?

• Cyber criminality is a new business model

– Financial profits can be huge (large scale)

– Better organized - more systematic, automated procedures are used

• TRIAGE can help to:

– Get better insights into how cyber criminals operate, or how / when they change their tactics

• Consequently, help improving detection or end-user protection systems

– Automate the identification of “networks” of attackers• Unless they completely change their modus operandi for each campaign…

– Go toward an early warning system

– Ultimately, support law-enforcement for stopping emerging / ongoing attack phenomena

21

22

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Overview

• Attack Attribution

• One example:

– the TRIAGE method (WOMBAT)

• Challenges, open issues

• Conclusions

23

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

The need for data

• Attack attribution is an emerging field

• It requires a multi disciplinary approach and international collaboration

• It requires access to stable, representative and diversified sets of data.

• Everyone is welcome to host an SGNET sensor and benefit from the dataset and tools generated by the project.

• The more sensors we can get, the more we will learn about the attacks.

24

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

The Symantec WINE initiative

• Symantec owns a very rich amount of threats related datasets.

• CARD is currently building an infrastructure to provide access to a sampled set of these data feeds.

• External researchers are welcome to submit research proposals to gain access to this infrastructure, for free, on site.

• CONTACT POINT: marc_dacier@symantec.com

25

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

Challenges and Open Issues

• A truly multidisciplinary domain:– Computer security, networking, knowledge mining, visualisation, law,

sociology, forensics, etc..

• Data can be private, confidential.

• Anonymisation is unlikely to be the silver bullet we need.

• Discovered knowledge can be sensitive ( from a technical, political, sociological or even business viewpoint).

• Do we have the right places to publish?

26

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

BACK UP MATERIAL

27

INCO-TRUST/NSF workshop, New York, USA, May 4, 2010marc_dacier@symantec.com

References

• Actionable Knowledge Discovery for Threats Intelligence Support Using a Multi-dimensional Data Mining Methodology, O.Thonnard (Royal Military Academy of Belgium) and M.Dacier (Symantec), Proc. of the IEEE Data Mining Workshops, 2008. ICDMW '08, Pisa, Italy, Dec. 15-19, 2008,

• Behavioral Analysis of Zombie Armies, O. Thonnard, W. Mees (Royal Military Academy of Belgium) and M. Dacier (Symantec), Proc. of Cyber Warfare Conference (CWCon), Cooperative Cyber Defense Center Of Excellence (CCD-COE), Tallinn, Estonia, June 17-19,

• Addressing the attack attribution problem using knowledge discovery and multi-criteria fuzzy decision-making, O. Thonnard, W. Mees (Royal Military Academy of Belgium) and M. Dacier (Symantec), Proc. of KDD’09, 15th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Workshop on CyberSecurity and Intelligence Informatics, Paris, France, June 28, 2009.

• Honeypot traces forensics: the observation view point matters, V.-H. Pham (Eurecom) and M. Dacier (Symantec), Proc. of the 3rd International Conference on Network and System Security, Gold Coast, Australia, Oct. 19-21, 2009