SECURE COMPUTER AND NETWORK SYSTEMS
PART I: AN OVERVIEW OF COMPUTER AND NETWORK SECURITY 1 ASSETS, VULNERABILITIES AND THREATS OF COMPUTER AND NETWORK SYSTEMS 1 1 RISK ASSESSMENT 1 2 ASSETS AND ASSET ATTRIBUTES 1 2 1 RESOURCE, PROCESS AND USER ASSETS AND THEIR INTERACTIONS 1 2 2 CAUSE–EFFECT CHAIN OF ACTIVITY, STATE AND PERFORMANCE 1 2 3 ASSET ATTRIBUTES 1 3 VULNERABILITIES 1 3 1 BOUNDARY CONDITION ERROR 1 3 2 ACCESS VALIDATION ERROR AND ORIGIN VALIDATION ERROR 1 3 3 INPUT VALIDATION ERROR 1 3 4 FAILURE TO HANDLE EXCEPTIONAL CONDITIONS 1 3 5 SYNCHRONIZATION ERRORS 1 3 6 ENVIRONMENT ERROR 1 3 7 CON?GURATION ERROR 1 3 8 DESIGN ERROR 1 3 9 UNKNOWN ERROR 1 4 THREATS 1 4 1 OBJECTIVE, ORIGIN, SPEED AND MEANS OF THREATS 1 4 2 ATTACK STAGES 1 5 ASSET RISK FRAMEWORK 1 6 SUMMARY REFERENCES 2 PROTECTION OF COMPUTER AND NETWORK SYSTEMS 2 1 CYBER ATTACK PREVENTION 2 1 1 ACCESS AND ?OW CONTROL 2 1 2 SECURE COMPUTER AND NETWORK DESIGN 2 2 CYBER ATTACK DETECTION 2 2 1 DATA, EVENTS AND INCIDENTS 2 2 2 DETECTION 2 2 3 ASSESSMENT 2 3 CYBER ATTACK RESPONSE 2 4 SUMMARY PART II SECURE SYSTEM ARCHITECTURE AND DESIGN 3 ASSET PROTECTION-DRIVEN, POLICY-BASED SECURITY PROTECTION ARCHITECTURE 3 1 LIMITATIONS OF A THREAT-DRIVEN SECURITY PROTECTION PARADIGM 3 2 A NEW, ASSET PROTECTION-DRIVEN PARADIGM OF SECURITY PROTECTION 3 2 1 DATA TO MONITOR: ASSETS AND ASSET ATTRIBUTES 3 2 2 EVENTS TO DETECT: MISMATCHES OF ASSET ATTRIBUTES 3 2 3 INCIDENTS TO ANALYZE AND RESPOND: CAUSE–EFFECT CHAINS OF MISMATCH EVENTS 3 2 4 PROACTIVE ASSET PROTECTION AGAINST VULNERABILITIES 3 3 DIGITAL SECURITY POLICIES AND POLICY-BASED SECURITY PROTECTION 3 3 1 DIGITAL SECURITY POLICIES 3 3 2 POLICY-BASED SECURITY PROTECTION 3 4 ENABLING ARCHITECTURE AND METHODOLOGY 3 4 1 AN ASSET PROTECTION DRIVEN SECURITY ARCHITECTURE (APDSA) 3 4 2 AN INSIDE-OUT AND OUTSIDE-IN (IOOI) METHODOLOGY OF GAINING KNOWLEDGE ABOUT DATA, EVENTS AND INCIDENTS 3 5 FURTHER RESEARCH ISSUES 3 5 1 TECHNOLOGIES OF ASSET ATTRIBUTE DATA ACQUISITION 3 5 2 QUANTITATIVE MEASURES OF ASSET ATTRIBUTE DATA AND MISMATCH EVENTS 3 5 3 TECHNOLOGIES FOR AUTOMATED MONITORING, DETECTION, ANALYSIS AND CONTROL OF DATA, EVENTS, INCIDENTS AND COA 3 6 SUMMARY 4 JOB ADMISSION CONTROL FOR SERVICE STABILITY 4 1 A TOKEN BUCKET METHOD OF ADMISSION CONTROL IN DIFFSERV AND INTESERV MODELS 4 2 BATCH SCHEDULED ADMISSION CONTROL (BSAC) FOR SERVICE STABILITY 4 2 1 SERVICE STABILITY IN SERVICE RESERVATION FOR INSTANTANEOUS JOBS 4 2 2 DESCRIPTION OF BSAC 4 2 3 PERFORMANCE ADVANTAGE OF THE BSAC ROUTER MODEL OVER A REGULAR ROUTER MODEL 4 3 SUMMARY 5 JOB SCHEDULING METHODS FOR SERVICE DIFFERENTIATION AND SERVICE STABILITY 5 1 JOB SCHEDULING METHODS FOR SERVICE DIFFERENTIATION 5 1 1 WEIGHTED SHORTEST PROCESSING TIME (WSPT), EARLIEST DUE DATE (EDD) AND SIMPLI?ED APPARENT TARDINESS COST (SATC) 5 1 2 COMPARISON OF WSPT, ATC AND EDD WITH FIFO IN THE BEST EFFORT MODEL AND IN THE DIFFSERV MODEL IN SERVICE DIFFERENTIATION 5 2 JOB SCHEDULING METHODS FOR SERVICE STABILITY 5 2 1 WEIGHTED SHORTEST PROCESSING TIME – ADJUSTED (WSPT-A) AND ITS PERFORMANCE IN SERVICE STABILITY 5 2 2 VERI?ED SPIRAL (VS) AND BALANCED SPIRAL (BS) METHODS FOR A SINGLE SERVICE RESOURCE AND THEIR PERFORMANCE IN SERVICE STABILITY 5 2 3 DYNAMICS VERI?ED SPIRAL (DVS) AND DYNAMIC BALANCED SPIRAL (DBS) METHODS FOR PARALLEL IDENTICAL RESOURCES AND THEIR PERFORMANCE IN SERVICE STABILITY 5 3 SUMMARY 6 JOB RESERVATION AND SERVICE PROTOCOLS FOR END-TO-END DELAY GUARANTEE 6 1 JOB RESERVATION AND SERVICE IN INTESERV AND RSVP 6 2 JOB RESERVATION AND SERVICE IN I-RSVP 6 3 JOB RESERVATION AND SERVICE IN SI-RSVP 6 4 SERVICE PERFORMANCE OF I-RSVP AND SI-RSVP IN COMPARISON WITH THE BEST EFFORT MODEL 6 4 1 THE SIMULATION OF A SMALL-SCALE COMPUTER NETWORK WITH I-RSVP, SI-RSVP AND THE BEST EFFORT MODEL 6 4 2 THE SIMULATION OF A LARGE-SCALE COMPUTER NETWORK WITH I-RSVP, SI-RSVP AND THE BEST EFFORT MODEL 6 4 3 SERVICE PERFORMANCE OF I-RSVP, SI-RSVP AND THE BEST EFFORT MODEL 6 5 SUMMARY PART III MATHEMATICAL/STATISTICALFEATURESANDCHARACTERISTICSOFATTACK AND NORMAL USE DATA 7 COLLECTION OF WINDOWS PERFORMANCE OBJECTS DATA UNDER ATTACK AND NORMAL USE CONDITIONS 7 1 WINDOWS PERFORMANCE OBJECTS DATA 7 2 DESCRIPTION OF ATTACKS AND NORMAL USE ACTIVITIES APACHE RESOURCE DOS ARP POISON DISTRIBUTED DOS FORK BOMB FTP BUFFER OVER?OW HARDWARE KEYLOGGER REMOTE DICTIONARY ROOTKIT SECURITY AUDIT SOFTWARE KEYLOGGER VULNERABILITY SCAN TEXT EDITING WEB BROWSING 7 3 COMPUTER NETWORK SETUP FOR DATA COLLECTION 7 4 PROCEDURE OF DATA COLLECTION 7 5 SUMMARY 8 MEAN SHIFT CHARACTERISTICS OF ATTACK AND NORMAL USE DATA 8 1 THE MEAN FEATURE OF DATA AND TWO-SAMPLE TEST OF MEAN DIFFERENCE 8 2 DATA PRE-PROCESSING 8 3 DISCOVERING MEAN SHIFT DATA CHARACTERISTICS FOR ATTACKS 8 4 MEAN SHIFT ATTACK CHARACTERISTICS EXAMPLES OF MEAN SHIFT ATTACK CHARACTERISTICS MEAN SHIFT ATTACK CHARACTERISTICS BY ATTACKS AND WINDOWS PERFORMANCE OBJECTS ATTACK GROUPINGS BASED ON THE SAME AND OPPOSITE ATTACK CHARACTERISTICS UNIQUE ATTACK CHARACTERISTICS 8 5 SUMMARY 9 PROBABILITY DISTRIBUTION CHANGE CHARACTERISTICS OF ATTACK AND NORMAL USE DATA 9 1 OBSERVATION OF DATA PATTERNS 9 2 SKEWNESS AND MODE TESTS TO IDENTIFY ?VE TYPES OF PROBABILITY DISTRIBUTIONS 9 3 PROCEDURE FOR DISCOVERING PROBABILITY DISTRIBUTION CHANGE DATA CHARACTERISTICS FOR ATTACKS 9 4 DISTRIBUTION CHANGE ATTACK CHARACTERISTICS PERCENTAGES OF THE PROBABILITY DISTRIBUTIONS UNDER THE ATTACK AND NORMAL USE CONDITIONS EXAMPLES OF DISTRIBUTION CHANGE ATTACK CHARACTERISTICS DISTRIBUTION CHANGE ATTACK CHARACTERISTICS BY ATTACKS AND WINDOWS PERFORMANCE OBJECTS 9 5 SUMMARY 10 AUTOCORRELATION CHANGE CHARACTERISTICS OF ATTACK AND NORMAL USE DATA 10 1 THE AUTOCORRELATION FEATURE OF DATA 10 2 DISCOVERING THE AUTOCORRELATION CHANGE CHARACTERISTICS FOR ATTACKS 10 3 AUTOCORRELATION CHANGE ATTACK CHARACTERISTICS 10 3 1 PERCENTAGES OF VARIABLES WITH THREE AUTOCORRELATION LEVELS UNDER THE ATTACK AND NORMAL USE CONDITIONS 10 3 2 EXAMPLES OF AUTOCORRELATION CHANGE ATTACK CHARACTERISTICS 10 3 3 AUTOCORRELATION CHANGE ATTACK CHARACTERISTICS BY ATTACKS AND WINDOWS PERFORMANCE OBJECTS 10 3 4 ATTACK GROUPINGS BASED ON THE SAME AND OPPOSITE ATTACK CHARACTERISTICS 10 3 5 UNIQUE ATTACK CHARACTERISTICS 10 4 SUMMARY 11 WAVELET CHANGE CHARACTERISTICS OF ATTACK AND NORMAL USE DATA 11 1 THE WAVELET FEATURE OF DATA 11 2 DISCOVERING THE WAVELET CHANGE CHARACTERISTICS FOR ATTACKS 11 3 WAVE CHANGE ATTACK CHARACTERISTICS 11 3 1 EXAMPLES OF WAVELET CHANGE ATTACK CHARACTERISTICS 11 3 2 WAVELET CHANGE ATTACK CHARACTERISTICS BY ATTACKS AND WINDOWS PERFORMANCE OBJECTS 11 3 3 ATTACK GROUPINGS BASED ON THE SAME AND OPPOSITE ATTACK CHARACTERISTICS 11 3 4 UNIQUE ATTACK CHARACTERISTICS 11 4 SUMMARY PART IV CYBER ATTACK DETECTION: SIGNATURE RECOGNITION 12 CLUSTERING AND CLASSIFYING ATTACK AND NORMAL USE DATA 12 1 CLUSTERING AND CLASSI?CATION ALGORITHM – SUPERVISED (CCAS) 12 2 TRAINING AND TESTING DATA 12 3 APPLICATION OF CCAS TO CYBER ATTACK DETECTION 12 4 DETECTION PERFORMANCE OF CCAS 12 5 SUMMARY 13 LEARNING AND RECOGNIZING ATTACK SIGNATURES USING ARTI?CIAL NEURAL NETWORKS 13 1 THE STRUCTURE AND BACK-PROPAGATION LEARNING ALGORITHM OF FEEDFORWARD ANNS 13 2 THE ANN APPLICATION TO CYBER ATTACK DETECTION 13 3 SUMMARY PART V CYBER ATTACK DETECTION: ANOMALY DETECTION 14 STATISTICAL ANOMALY DETECTION WITH UNIVARIATE AND MULTIVARIATE DATA 14 1 EWMA CONTROL CHARTS 14 2 APPLICATION OF THE EWMA CONTROL CHART TO CYBER ATTACK DETECTION 14 3 CHI-SQUARE DISTANCE MONITORING (CSDM) METHOD 14 4 APPLICATION OF THE CSDM METHOD TO CYBER ATTACK DETECTION 14 5 SUMMARY 15 STOCHASTIC ANOMALY DETECTION USING THE MARKOV CHAIN MODEL OF EVENT TRANSITIONS 15 1 THE MARKOV CHAIN MODEL OF EVENT TRANSITIONS FOR CYBER ATTACK DETECTION 15 2 DETECTION PERFORMANCE OF THE MARKOV CHAIN MODEL-BASED ANOMALY DETECTION TECHNIQUE AND PERFORMANCE DEGRADATION WITH THE INCREASED MIXTURE OF ATTACK AND NORMAL USE DATA 15 3 SUMMARY PART VI CYBER ATTACK DETECTION: ATTACK NORM SEPARATION 16 MATHEMATICAL AND STATISTICAL MODELS OF ATTACK DATA AND NORMAL USE DATA 16 1 THE TRAINING DATA FOR DATA MODELING 16 2 STATISTICAL DATA MODELS FOR THE MEAN FEATURE 16 3 STATISTICAL DATA MODELS FOR THE DISTRIBUTION FEATURE 16 4 TIME-SERIES BASED STATISTICAL DATA MODELS FOR THE AUTOCORRELATION FEATURE 16 5 THE WAVELET-BASED MATHEMATICAL MODEL FOR THE WAVELET FEATURE 16 6 SUMMARY 17 CUSCORE-BASED ATTACK NORM SEPARATION MODELS 17 1 THE CUSCORE 17 2 APPLICATION OF THE CUSCORE MODELS TO CYBER ATTACK DETECTION 17 3 DETECTION PERFORMANCE OF THE CUSCORE DETECTION MODELS 17 4 SUMMARY