CyberVAN: A Cyber Security Virtual Assured Network testbed

Chadha, Ritu; Bowen, Thomas F.; Chiang, Cho‐Yu Jason; Gottlieb, Yitzchak M.; Poylisher, Alex; Angello, Sapello; Serban, Constantin; Sugrim, Shridatt; Walther, Gary; Marvel, Lisa M.; Newcomb, E. Allison; Savage, Jonathan

doi:10.1109/milcom.2016.7795481

Cited by 37 publications

(29 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…To understand the impact of different monitoring points on processing time and accuracy of a detection mechanism, we simulated the network scenario of Figure in the CyberVAN testbed, which can generate benign user traffic . In the network of Figure , we consider a stealthy botnet with a communication architecture composed of a server in the DMZ and four compromised hosts, two in Subnet‐1 and two in Subnet‐2.…”

Section: Preprocessing Phasementioning

confidence: 65%

“…Testbed . All the experiments were conducted on the cyber virtual assured network (CyberVAN) testbed . CyberVAN is a state‐of‐the‐art testbed designed to provide a realistic network environment to test and evaluate cyber security models.…”

Section: Discussionmentioning

confidence: 99%

“…Therefore, it is crucial to identify the most effective set of monitoring points so as to limit the amount of data to be analyzed, while ensuring that a sufficient number of malicious flows are intercepted for the detection mechanism to be able to distinguish malicious flows from benign flows. To understand the impact of different monitoring points on processing time and accuracy of a detection mechanism, we simulated the network scenario of Figure 2 in the CyberVAN testbed, 8 which can generate benign user traffic. † In the network of Figure 2, we consider a stealthy botnet with a communication architecture composed of a server in the DMZ and four compromised hosts, two in Subnet-1 and two in Subnet-2.…”

Section: Selecting An Optimal Set Of Monitoring Pointsmentioning

confidence: 99%

“…All the experiments were conducted on the cyber virtual assured network (CyberVAN) testbed. 8 CyberVAN is a state-of-the-art testbed designed to provide a realistic network environment to test and evaluate cyber security models. In CyberVAN, applications run on virtual machines and the network traffic generated by the host machines is forwarded to the destination through a simulated network.…”

Section: Experimental Settingmentioning

confidence: 99%

See 3 more Smart Citations

DeBot: A novel network‐based mechanism to detect exfiltration by architectural stealthy botnets

Sridhar¹,

Albanese

Chiang³

et al. 2018

Security and Privacy

Self Cite

View full text Add to dashboard Cite

Malicious actors use networks of compromised and remotely controlled hosts, known as botnets, to execute different classes of cyberattacks, including exfiltration of sensitive data. Recently, we have observed a trend toward more resilient botnet architectures, departing from traditional centralized architectures and enabling botnets to evade detection and persist in a system indefinitely. Botnets can achieve resilience through architectural stealth, by establishing overlay networks that minimize exposure of malicious traffic to detectors. To address this problem, we propose a novel network‐based detection scheme, called DeBot, which identifies traffic flows associated with exfiltration attempts. The proposed solution intercepts traffic from different monitoring points and leverages differences in the network behavior of botnets and benign users to identify suspicious flows. To this aim, we first develop a mechanism to identify monitoring points that are likely to intercept a significant volume of malicious traffic. Then, we analyze flow characteristics to identify suspicious hosts and use periodogram analysis to identify malicious flows originating from those hosts. We evaluate the proposed approach against different botnets in the CyberVAN testbed and compare its performance against state‐of‐the‐art detection techniques. The results indicate that DeBot is effective in detecting botnet activity, thus enabling the identification and removal of bots.

show abstract

Section: Preprocessing Phasementioning

confidence: 65%

Section: Discussionmentioning

confidence: 99%

Section: Selecting An Optimal Set Of Monitoring Pointsmentioning

confidence: 99%

Section: Experimental Settingmentioning

confidence: 99%

See 2 more Smart Citations

DeBot: A novel network‐based mechanism to detect exfiltration by architectural stealthy botnets

Sridhar¹,

Albanese

Chiang³

et al. 2018

Security and Privacy

Self Cite

View full text Add to dashboard Cite

show abstract

“…3) CyberVAN Testbed: [124] provides a testing and experimentation platform for cybersecurity research. The platform supports high fidelity network, by representing the network in a discrete event simulator.…”

Section: Mtd Testbeds: Research and Prototypingmentioning

confidence: 99%

A Survey of Moving Target Defenses for Network Security

Sengupta

Chowdhary

Sabur

et al. 2020

IEEE Commun. Surv. Tutorials

154

View full text Add to dashboard Cite

Network defense techniques based on traditional tools, techniques, and procedures (TTP) fail to account for the attacker's inherent advantage present due to static nature of network services and configurations. Moving Target Defense (MTD), on the other hand, provides an intelligent countermeasure by dynamically re-configuring the underlying systems, thereby reducing the effectiveness of cyber attacks. In this survey, we analyze the recent advancements made in the development of MTD tools, techniques and procedures (TTP) and highlight how these defenses can be made more effective with the use of artificial intelligence techniques for decision making. We first define a unified formal notation for MTDs that can capture different aspects of such defenses. We then categorize these defenses into different sub-classes depending on how they answer the three questions-what to move, when to move and how to moveshowcasing how game theoretic strategies can effectively answer the latter question. To understand the usefulness of these defense methods, we study the implementation of such MTD techniques. We find that (relatively) new networking technologies such as Software Defined Networking (SDN) and Network Function Virtualization (NFV) provide effective means for implementing these dynamic defense methods. To encourage researchers and industry experts in using such defenses, we highlight industry use-cases and discuss the practicality and maturity of these defenses. To aid readers who want to test or deploy MTD techniques, we highlight existing MTD test-beds. Our survey then performs both a qualitative and quantitative analysis to better understand the effectiveness of these MTDs in terms of security and performance. To that extent, we use well-defined metrics such as risk analysis, performance costs for qualitative evaluation and metrics based on Confidentiality, Integrity, Availability (CIA), attack representation, QoS impact, targeted threat models and defense cost for quantitative evaluation. Finally, we conclude by summarizing research opportunities that our survey elucidates.

show abstract

Bibliography

2018

An Introduction to Cyber Modeling and Simulation

View full text Add to dashboard Cite

CyberVAN: A Cyber Security Virtual Assured Network testbed

Cited by 37 publications

References 6 publications

DeBot: A novel network‐based mechanism to detect exfiltration by architectural stealthy botnets

DeBot: A novel network‐based mechanism to detect exfiltration by architectural stealthy botnets

A Survey of Moving Target Defenses for Network Security

Bibliography

Contact Info

Product

Resources

About