Research Projects

Network Security Vulnerability via Large Scale Simulation (Joint work with Dr. Riley and Dr. Abler)

Virtually every system connected to the Internet today has been the target of malicious or unsolicited activity at some point in time. These activities can be as harmless as a simple exploratory ICMP messages to discover where hosts reside, to complete destruction of services requiring a time-consuming and disruptive system restart. A large group of hackers are continually developing and launching new and innovative techniques to exploit security weaknesses in existing systems. Other groups of individuals and companies are at the same time developing techniques to detect and defend against these attacks, in an effort to reduce or eliminate disruptions due this activity. These defensive methods are collectively known as Intrusion Detection (ID) systems.

The effectiveness of intrusion detection systems is difficult to measure for a variety of reasons. Commercial vendors of intrusion detection systems can easily demonstrate the effectiveness of their product using pre-recorded scripts that generate network traffic simulating various attacks. Researchers developing new and innovative defensive measures can also demonstrate the effectiveness of their techniques under a variety of conditions. However, once deployed, the intrusion detection system must work properly in the presence of a large amount of legitimate traffic as well as the malicious and erroneous traffic. The mix of legitimate and malicious traffic, frequency of attacks, duration of attacks, number of end-systems participating in the attacks, and network bandwidth available to the attackers all have substantial effect on the success (or failure) of an intrusion detection system.

In this research, we are designing and implementing a large-scale network simulation framework that will allow researchers in the network security arena to generate scenarios of simulated network behavior using a wide variety of parameters. Our simulation framework will be capable of generating network activity with any mix of legitimate traffic, malicious traffic, network bandwidth, network size, number of attackers, type of attacks, and type of defensive techniques, just to name a few. Building on our previously developed parallel and distributed simulation methods, the framework will support simulated models of hundreds of thousands of end systems and routers. Using our models, researchers can measure and evaluate the effectiveness of security measures under a virtually unlimited set of conditions.

Large Scale Network Simulation of Security and Survivability (Joint work with Dr. Riley and Dr. Blough)

The Internet routing infrastructure and domain name infrastructure are huge and highly dynamic systems. Understanding and predicting the functionality and behavior of these systems is highly complex. As is true in many cases, detailed modeling and simulation of complex systems can help in understanding their behavior, both in a predictive mode and in a reactive environment. With a high quality simulation model of such a system, one can predict the affect of proposed changes, and can understand causes of prior failures. Further, one can model disruptive actions in the simulated environment without affecting deployed systems. Such an understanding of cause and affect in these systems is critical to the long--term stability of the Internet infrastructure. The security and continued functioning of the Internet will be greatly influenced by the success or failure of implementing more secure and more robust BGP and DNS. Simulation of these BGP and DNS infrastructures is critical to the process of implementing more secure and more robust protocols. In the proposed research, we perform Internet-scale simulations of these infrastructures in order to better understand their vulnerabilities, quantitatively evaluate the damage caused to them by various types of attacks, and develop enhancements that provide substantially more robust network infrastructures.

Network Security Visualization (Joint work with Dr. Ahamad, Dr. Stasko, Dr. Copeland, Greg Conti, Jeff Gribschaw)

Security has become the pivotal part in network operations. The state of the art is automated intrusion detection systems that raise alarms to be evaluated by a human analyst. However, being machine-based, those systems always have to cope with the trade-off of overlooking hostile activity (false-negatives) to raising alarms because of benign activity (false-positives). On a huge network, the number of the latter becomes so extensive that an in-depth evaluation by the operator is not possible.

Through visualization, the human can be kept closer in the loop and the extensive bandwidth capabilities of the human visual system can be leveraged. A human will inherently detect different visual signatures and anomalies. Historically, such fields as machine vision and machine learning have shown that tasks in which a machine stands out are typically entirely different from those a human excels in. Thus, we believe that human-enhanced visual network intrusion systems working symbiotically with classical machine-based systems will enable network operators to both be more aware of the state of the network and detect attacks on the network infrastructure more precisely and timely. The Internet has become one of the world’s critical infrastructures. However, the large amounts of data transmitted over typical networked systems render it hard to spot malicious activities by illegitimate adversaries—posing a challenge equivalent to “finding the needle in the haystack.” Relevant data in the information assurance domain can be gathered from a large amount of heterogeneous, diverse, and distributed sources including packet capture data, firewall logs, data from network management systems, network performance systems, and anti-virus systems.  As of now, there is neither an efficient way to access and gather all this data in a unified fashion nor a methodology that allows browsing and analyzing this vast amount of information in a timely manner. A powerful and as yet predominately untapped means to achieve this goal is to use visualization to allow human analysts both undirected (getting a general overview about occurrences on the network) as well as directed (displaying and analyzing information regarding a specific incident) processing of the data. Our constant battle with information overload during daily analysis activities with our Georgia Institute of Technology Honeynet and our extensive two-year archive of malicious traffic collected on that honeynet setup motivated us to investigate more human-centric, scalable techniques for the analysis of security data sets.

 Intrusion Recovery Systems (with Julian Grizzard)

We are investigating integrated intrusion recovery systems (IRS). The notion of an intrusion recovery system follows naturally from the notions of intrusion detection systems (IDS) and intrusion prevention systems (IPS). The goal of an intrusion recovery system is detect intrusions after they have occurred and to take recoverable actions to mitigate the attackers intrusions. By a vertically integrated IRS, we propose a four tier system for each Virtual Machine running beside the operating system we are protecting as described below:

The recovery techniques that we propose build on existing techniques, which use VM check pointing and rollback, and more novel techniques in which the full extent of the compromise is understood. In a worst case scenario, it may be desirable to completely roll back to a previous VM configuration that is known to be good. This would be one option for our proposed system. There are, however, problems with this solution. One problem is that whatever state that was processed since the last checkpoint is lost. Another problem is that the original security hole might be present in the restored version. Finally, there may be more optimal methods for recovery in which only the compromised portion of the machine is repaired so that the recovery process is executed more efficiently. Therefore, we propose new methods to recover from compromises that address these problems. Below we outline some of the details of our proposed approach for recovery.