idsNETS: An experimental platform to study situation awareness for intrusion detection analysts

Mancuso, Vincent; Minotra, Dev; Giacobe, Nicklaus A.; McNeese, Michael D.; Tyworth, Michael

doi:10.1109/cogsima.2012.6188411

Cited by 18 publications

(11 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The field will also continue to struggle with the tradeoffs between maintaining internal and external validity. Toward that end, conducting human-in-the-loop cyber-defense research in the laboratory setting appears difficult, because the platform and simulation capabilities are still being developed (see CyberCog -Champion et al, 2012, which is being built into DEXTAR -Shope, 2013; and the idsNETs testbed - Mancuso et al, 2012). Note that this struggle is fundamentally similar to the recent problems overcome in experimentation in multiple unmanned vehicle control.…”

Section: Discussionmentioning

confidence: 99%

The Human Factors of Cyber Network Defense

Gutzwiller

Fugate

Sawyer

et al. 2015

Proceedings of the Human Factors and Ergonomics Society Annual

View full text Add to dashboard Cite

Technology's role in the fight against malicious cyber-attacks is critical to the increasingly networked world of today. Yet, technology does not exist in isolation: the human factor is an aspect of cyber-defense operations with increasingly recognized importance. Thus, the human factors community has a unique responsibility to help create and validate cyber defense systems according to basic principles and design philosophy. Concurrently, the collective science must advance. These goals are not mutually exclusive pursuits: therefore, toward both these ends, this research provides cyber-cognitive links between cyber defense challenges and major human factors and ergonomics (HFE) research areas that offer solutions and instructive paths forward. In each area, there exist cyber research opportunities and realms of core HFE science for exploration. We raise the cyber defense domain up to the HFE community at-large as a sprawling area for scientific discovery and contribution.

show abstract

Section: Discussionmentioning

confidence: 99%

The Human Factors of Cyber Network Defense

Gutzwiller

Fugate

Sawyer

et al. 2015

Proceedings of the Human Factors and Ergonomics Society Annual

View full text Add to dashboard Cite

show abstract

“…Situation awareness (SA) literature specifically discusses how systems can support multiple levels of SA in relation to expertise, which can act as guidelines for system development and design [38]. Additional cyber SA literature and ongoing research [39][40][41][42] also may help guide application design specifically for cyber security.…”

Section: Implications For Technology Developmentmentioning

confidence: 99%

Identifying Expertise Gaps in Cyber Incident Response: Cyber Defender Needs vs. Technological Development

Nyre-Yu¹

2021

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Incident response is an area within cyber defense that is responsible for detecting, mitigating, and preventing threats within a given network. Like other areas of cyber security, incident response is experiencing a shortage of qualified workers which has led to technological development aimed at alleviating labor-related pressures on organizations. A cognitive task analysis was conducted with incident response experts to capture expertise requirements and used an existing construct to help prioritize development of new technology. Findings indicated that current software development incorporates factors such as analyst efficiency and consistency. Gaps were identified regarding communication and team navigation that are inherent to dynamic team environments. This research identified which expertise areas are needed at lower-tier levels of incident response and which of those areas current automation platforms are addressing. These gaps help focus future studies by bridging expertise research to development efforts.

show abstract

“…While situational awareness might be applied to more physical domains, the potential of its implementation in the cyber realm is starting to be realized. The authors of idsNETS (Mancuso et al, 2012) realized this and are developing a system to test how users with varying degrees of cyber secu-rity knowledge understand this concept by seeing how they defend a system/network against multiple attacks, some more harmful than others. Their work focuses on studying studying situational awareness instead of its implementation.…”

Section: Related Workmentioning

confidence: 99%

Detecting Botnets using a Collaborative Situational-aware IDPS

Mathews

Joshi

Finin

2016

Proceedings of the 2nd International Conference on Information Systems Security and Privacy

View full text Add to dashboard Cite

Botnet attacks turn susceptible victim computers into bots that perform various malicious activities while under the control of a botmaster. Some examples of the damage they cause include denial of service, click fraud, spamware, and phishing. These attacks can vary in the type of architecture and communication protocol used, which might be modified during the botnet lifespan. Intrusion detection and prevention systems are one way to safeguard the cyber-physical systems we use, but they have difficulty detecting new or modified attacks, including botnets. Only known attacks whose signatures have been identified and stored in some form can be discovered by most of these systems. Also, traditional IDPSs are point-based solutions incapable of utilizing information from multiple data sources and have difficulty discovering new or more complex attacks. To address these issues, we are developing a semantic approach to intrusion detection that uses a variety of sensors collaboratively. Leveraging information from these heterogeneous sources leads to a more robust, situational-aware IDPS that is better equipped to detect complicated attacks such as botnets.

show abstract

idsNETS: An experimental platform to study situation awareness for intrusion detection analysts

Cited by 18 publications

References 16 publications

The Human Factors of Cyber Network Defense

The Human Factors of Cyber Network Defense

Identifying Expertise Gaps in Cyber Incident Response: Cyber Defender Needs vs. Technological Development

Detecting Botnets using a Collaborative Situational-aware IDPS

Contact Info

Product

Resources

About