Creating a cyber moving target for critical infrastructure applications using platform diversity

Okhravi, Hamed; Comella, Adam; Robinson, Eric; Haines, J.W.

doi:10.1016/j.ijcip.2012.01.002

Cited by 62 publications

(25 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Talent [11] is a framework for live-migrating critical applications across diverse platforms that has several design goals: i) diversity at the instruction set architecture level, ii) diversity at the operating system level, iii) preservation of the state of the application, including the execution state, open files and sockets, and iv) working with a general-purpose, system language such as C. While the analysis we present in this paper is applicable across a broad range of technologies, we notionally use Talent as our target system as it provides both temporal changes (periodic migrations) and diversity (multiple operating systems).…”

Section: Related Workmentioning

confidence: 99%

“…One such paradigm is moving target (MT) defense based on dynamic platform techniques, which dynamically change the properties of a computing platform in order to complicate attacks [12]. These properties that are dynamically adjusted focus around: the instructions being executed [20,19,9,7] and their architecture [4], system and application memory [17,16,6,15], operating system (OS) distribution [11], and machine instance [14].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Game Theoretic Approach to Strategy Determination for Dynamic Platform Defenses

Carter

Riordan

Okhravi

2014

Proceedings of the First ACM Workshop on Moving Target Defense

Self Cite

View full text Add to dashboard Cite

Moving target defenses based on dynamic platforms have been proposed as a way to make systems more resistant to attacks by changing the properties of the deployed platforms. Unfortunately, little work has been done on discerning effective strategies for the utilization of these systems, instead relying on two generally false premises: simple randomization leads to diversity and platforms are independent. In this paper, we study the strategic considerations of deploying a dynamic platform system by specifying a relevant threat model and applying game theory and statistical analysis to discover optimal usage strategies. We show that preferential selection of platforms based on optimizing platform diversity approaches the statistically optimal solution and significantly outperforms simple randomization strategies. Counter to popular belief, this deterministic strategy leverages fewer platforms than may be generally available, which increases system security.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

A Game Theoretic Approach to Strategy Determination for Dynamic Platform Defenses

Carter

Riordan

Okhravi

2014

Proceedings of the First ACM Workshop on Moving Target Defense

Self Cite

View full text Add to dashboard Cite

show abstract

“…We have worked with stateless protocols, and thus, we have not needed to transfer state from real to emulated services. Transferring state is an additional complication, but has been addressed previously [10].…”

Section: Emulationmentioning

confidence: 99%

“…If there were no 9 See http://code.google.com/p/vmitools/ (accessed 9/20/12). 10 See http://code.google.com/p/volatility/ (accessed 9/20/12). differences between normal and emulated services, then the attacker would have access to the same information through either of those services.…”

Section: Cocooningmentioning

confidence: 99%

See 1 more Smart Citation

Machine-oriented biometrics and cocooning for dynamic network defense

Haas

Doak

Hamlet

2013

Proceedings of the Eighth Annual Cyber Security and Information Intelligence Research Workshop

View full text Add to dashboard Cite

Current cyber defenses result in binary access for attackers who have compromised a host: either the attacker has full access to the machine or the intrusion is detected and the machine is removed from the network. This is the result of an apparent duality when determining if a system is compromised; i.e., either it is or it is not. However, analysts usually make decisions based upon many pieces of data and their own experience, which may lend itself to higher resolution in the decision-making process. We propose using machine-oriented indicators of compromise to trigger progressive, incremental cocooning of a machine by replacing real network services with their emulated counterparts, which are indistinguishable from real services to attackers. The emulated services will be instrumented to gather additional details about an attacker's tools and techniques. Incremental cocooning reduces the effect on normal users' experiences.

show abstract