Utilizing Network Science and Honeynets for Software Induced Cyber Incident Analysis

Abstract

Increasing situational awareness and investigating the cause of a software-induced cyber attack continues to be one of the most difficult yet important endeavors faced by network security professionals. Traditionally, these forensic pursuits are carried out by manually analyzing the malicious software agents at the heart of the incident, and then observing their interactions in a controlled environment. Both these steps are time consuming and difficult to maintain due to the ever changing nature of malicious software. In this paper we introduce a network science based framework which conducts incident analysis on a dataset by constructing and analyzing relational communities. Construction of these communities is based on the connections of topological features formed when actors communicate with each other. We evaluate our framework using a network trace of the BlackEnergy malware network, captured by our honeynet. We have found that our approach is accurate, efficient, and could prove as a viable alternative to the current status quo.

Cyber Deception for Computer and Network Security: Survey and Challenges

“…Cyber deception aims at injecting intentionally falsified information to mislead the attackers during their attack planning stage. For example, the early honeypot systems [11], [12] intend to attract potential attackers to waste their time while in the meantime trying to learn attackers' strategies.…”

Security Framework based on Trusted Computing for Industrial Control Systems of CNC Machines

“…For example, the "STUXNET" [4] virus that appeared in 2010 attacked the Iranian nuclear power plant system and caused serious damage; this was a warning that a great deal of attention needed to be paid to ICS security. Moreover, on December 23rd, 2015, the Ukrainian electric power network was attacked by BlackEnergy, which eventually led to system paralysis [5]. In other countries, their ICSs also face security problems.…”