create moving target defense in static networks by learning … · 2012-03-28 · create moving...

Create Moving Target Defense in Static Networks by Learning from Botnets Feng Li, Assistant Professor, [email protected] This project will deliver an moving‐target defense (MTD) framework, in which the network configuration constantly evolves to confuse attackers without significantly degrading the quality of service. The MTD framework increases the cost for potential attackers by complicating the attack process and limiting the exposure of network vulnerability, and thus makes the network more resilient against persistent attacks. Moving-Target Defense Example: Operation Ghost Click • A botnet with millions of infected computers • Crackdown by FBI Why? Static target. • Centralized Command and Control (C&C) architecture • Poisoning attack by FBI Anti‐crackdown? Trojan.Peacomm botnet and Storm worm [1]. 1) Dynamic C&C mechanisms; 2) Multiple attack vectors and the strategy of using them; 3) Disruption‐tolerant P2P update sharing; 4) Index poisoning prevention . Botnet Lesson Roadmap: Physically static networks Targets of disruptive attacks ↑ Moving‐target techniques ← Success of recent botnets Three major thrusts: • Polymorphism: evolving network topology • Agility: security‐context‐aware opportunistic data exchange • Poisoning prevention: dynamic group creation and secret sharing MTD Framwork: Against disruptive attacks Dynamic C&C structure inspires network topological polymorphism Quantitative security exposure measurement • Attack exposure measure: accumulated risk of being compromised over time Globally coordinated mechanisms Locally coordinated virtual node mechanism Locally coordinated probabilistic switching mechanism Polymorphism Links are still vulnerable to the network disruptive attacks • Single fixed route Locally coordinated opportunistic data forwarding • Adaptive relay set selection • Probabilistic priority determination Agility Poisoning techniques: A severe threat to the MTD framework Arbitrary subset of nodes a privileged subgroup No online central authority Dynamic secret sharing mechanism based on private polynomial and public values Poisoning prevention [1] T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling. Measurements and mitigation of peer‐to‐peer‐based botnets: a case study on storm worm. In Proc. of the 1st Usenix Workshop on Large‐Scale Exploits and Emergent Threats, 2008. [2] E. Al‐Shaer. Toward network configuration randomization for moving target defense. In Moving Target Defense, volume 54 of Advances in Information Security, pages 153–159. Springer New York, 2011. Botnet Lesson 159-98E.pdf 1 3/28/2012 9:08:00 AM

Upload: others

Post on 26-Mar-2020

0 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Create Moving Target Defense in Static Networks by Learning … · 2012-03-28 · Create Moving Target Defense in Static Networks by Learning from Botnets Feng Li, Assistant Professor,

Create Moving Target Defense in Static Networks by Learning from BotnetsFeng Li, Assistant Professor, [email protected]

This project will deliver an moving‐target defense (MTD)framework, in which the network configuration constantlyevolves to confuse attackers without significantly degradingthe quality of service. The MTD framework increases the costfor potential attackers by complicating the attack process andlimiting the exposure of network vulnerability, and thus makesthe network more resilient against persistent attacks.

Moving-Target Defense

Example: Operation Ghost Click• A botnet with millions of infected computers• Crackdown by FBI

Why? Static target.• Centralized Command and Control (C&C) architecture• Poisoning attack by FBI

Anti‐crackdown? Trojan.Peacomm botnet and Storm worm [1].1) Dynamic C&C mechanisms;2) Multiple attack vectors and the strategy of using them;3) Disruption‐tolerant P2P update sharing;4) Index poisoning prevention .

Botnet Lesson

Roadmap:Physically static networks Targets of disruptive attacks

↑Moving‐target techniques← Success of recent botnets

Three major thrusts:• Polymorphism: evolving network topology• Agility: security‐context‐aware opportunistic data exchange• Poisoning prevention: dynamic group creation and secret

sharing

MTD Framwork: Against disruptive attacks

Dynamic C&C structure inspiresnetwork topological polymorphism

Quantitative security exposure measurement• Attack exposure measure: accumulated risk of being

compromised over time

Globally coordinated mechanismsLocally coordinated virtual node mechanismLocally coordinated probabilistic switching mechanism

Polymorphism

Links are still vulnerable to the network disruptive attacks• Single fixed route

Locally coordinated opportunistic data forwarding• Adaptive relay set selection• Probabilistic priority determination

Agility

Poisoning techniques: A severe threat to the MTD framework

Arbitrary subset of nodes a privileged subgroupNo online central authority

Dynamic secret sharing mechanism based on private polynomial and public values

Poisoning prevention

[1] T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling. Measurements and mitigation of peer‐to‐peer‐based botnets: a case study on storm worm. In Proc. of the 1st Usenix Workshop on Large‐Scale Exploits and Emergent Threats, 2008.[2] E. Al‐Shaer. Toward network configuration randomization for moving target defense. In Moving Target Defense, volume 54 of Advances in Information Security, pages 153–159. Springer New York, 2011.

Botnet Lesson

159-98E.pdf 1 3/28/2012 9:08:00 AM

mfocosi

Typewritten Text

2012 - 159-98E - Create Moving Target Defense in Static Networks by Learning from Botnets - Feng Li NS

MOVING THE WEBQUEST PROCESS FROM STATIC TO DYNAMIC ...etd.lib.metu.edu.tr/upload/12608554/index.pdf · moving the webquest process from static to dynamic: preservice teachers’ experience

Realtime Moving Object Detection from a Freely Moving ...€¦ · The solution to the moving object detection and segmen-tation problem will act as a bridge between the static SLAM

MOVING THE WEBQUEST PROCESS FROM STATIC TO …MOVING THE WEBQUEST PROCESS FROM STATIC TO DYNAMIC: ... 4.2.3 What are the views of the participants about designing their WebQuest

Static Electricity · 2020-04-25 · Static Electricity Static Electricity does not flow through wires. — Static means "not moving." If the charge is strong enough, it "jumps" from

Re-Cinematography: Improving the Camera Dynamics of Casual ... · Translate cinematography to implementation Motion should be intentional •Static shots should be static •Moving

Moving from Static to Dynamic General Equilibrium Economic Models

Moving from Defense to Offense - accenture.com