More Like this

1. Decepticon: A Hidden Markov Model Approach to Counter Advanced Persistent Threats

   Baksi, Rudraprasad; Upadhyaya, Shambhu (December 2019, Secure Knowledge Management In Artificial Intelligence Era (SKM 2019))

   Deception has been proposed in the literature as an effective defense mechanism to address Advanced Persistent Threats (APT). However, administering deception in a cost-effective manner requires a good understanding of the attack landscape. The attacks mounted by APT groups are highly diverse and sophisticated in nature and can render traditional signature based intrusion detection systems useless. This necessitates the development of behavior oriented defense mechanisms. In this paper, we develop Decepticon (Deception-based countermeasure) a Hidden Markov Model based framework where the indicators of compromise (IoC) are used as the observable features to aid in detection. This framework would help in selecting an appropriate deception script when faced with APTs or other similar malware and trigger an appropriate defensive response. The effectiveness of the model and the associated framework is demonstrated by considering ransomware as the offending APT in a networked system. 

   more » « less
2. Apt Epistemic Practices in a High School Science Classroom: A Contrastive Case Study

   Hussain-Abidi, Huma; Chinn, Clark A; Yoon, Susan A; Cottone, Amanda M; Noushad, Noora F; Richman, Thomas (June 2022, International Society of the Learning Sciences)

   In the current “post-truth” era, there is a growing need to promote apt epistemic practices in science education. In this study, we investigated two high-school biology students’ epistemic practices during a modeling unit and appraised them for aptness using the Apt-AIR framework. Additionally, we analyzed their responses to a post-implementation focus group interview, designed to elicit their metacognition regarding epistemic practices, as they answered probing questions about practices within the curriculum and reflected on video clips of other students engaging with the units. We document the epistemic practices that students engage in during a modeling unit and evaluate the extent to which they are apt. Findings suggest a disassociation between students’ cognitive engagement in modeling practices and their metacognitive understanding. 

   more » « less
3. Deceiving Cyber Adversaries: A Game Theoretic Approach

   Schlenker, Aaron; Thakoor, Omkar; Xu, Haifeng; Tambe, Milind; Vayanos, Phebe; Fang, Fei; Tran-Thanh, Long; Vorobeychik, Yevgeniy (January 2018, International Conference on Autonomous Agents and Multiagent Systems)

   An important way cyber adversaries ind vulnerabilities in mod- ern networks is through reconnaissance, in which they attempt to identify coniguration speciics of network hosts. To increase un- certainty of adversarial reconnaissance, the network administrator (henceforth, defender) can introduce deception into responses to network scans, such as obscuring certain system characteristics. We introduce a novel game theoretic model of deceptive interac- tions of this kind between a defender and a cyber attacker, which we call the Cyber Deception Game. We consider both a powerful (rational) attacker, who is aware of the defender’s exact deception strategy, and a naive attacker who is not. We show that computing the optimal deception strategy is NP-hard for both types of attackers. For the case with a powerful attacker, we provide a mixed-integer linear program solution as well as a fast and efective greedy algo- rithm. Similarly, we provide complexity results and propose exact and heuristic approaches when the attacker is naive. Our exten- sive experimental analysis demonstrates the efectiveness of our approaches. 

   more » « less
4. Misdirection in Robot Teams: Methods and Ethical Considerations

   Arkin, Ronald C. (April 2019, 2019 International Association for Computing and Philosophy annual conference)

   Trust, dependability, cohesion, and capability are integral to an effective team. These attributes are the same for teams of robots. When multiple teams with competing incentives are tasked, a strategy, if available, may be to weaken, influence or sway the attributes of other teams and limit their understanding of their full range of options. Such strategies are widely found in nature and in sporting contests such as feints, misdirection, etc. This talk focuses on one class of higher-level strategies for multi-robots, i.e., to intentionally misdirect using shills or confederates where needed, and the ethical considerations associated with deploying such teams. As multi-robot systems become more autonomous, distributed, networked, numerous, and with more capability to make critical decisions, the prospect for intentional and unintentional misdirection must be anticipated. While benefits are clearly apparent to the team performing the deception, ethical questions surrounding the use of misdirection or other forms of deception are quite real. 

   more » « less
5. NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation

   https://doi.org/10.14722/ndss.2024.23204  

   Li, Shaofei; Dong, Feng; Xiao, Xusheng; Wang, Haoyu; Shao, Fei; Chen, Jiedong; Guo, Yao; Chen, Xiangqun; Li, Ding (January 2024, Internet Society)

   Advanced Persistent Threats (APT) attacks have plagued modern enterprises, causing significant financial losses. To counter these attacks, researchers propose techniques that capture the complex and stealthy scenarios of APT attacks by using provenance graphs to model system entities and their dependencies. Particularly, to accelerate attack detection and reduce financial losses, online provenance-based detection systems that detect and investigate APT attacks under the constraints of timeliness and limited resources are in dire need. Unfortunately, existing online systems usually sacrifice detection granularity to reduce computational complexity and produce provenance graphs with more than 100,000 nodes, posing challenges for security admins to interpret the detection results. In this paper, we design and implement NODLINK, the first online detection system that maintains high detection accuracy without sacrificing detection granularity. Our insight is that the APT attack detection process in online provenance-based detection systems can be modeled as a Steiner Tree Problem (STP), which has efficient online approximation algorithms that recover concise attack-related provenance graphs with a theoretically bounded error. To utilize the frameworks of the STP approximation algorithm for APT attack detection, we propose a novel design of in-memory cache, an efficient attack screening method, and a new STP approximation algorithm that is more efficient than the conventional one in APT attack detection while maintaining the same complexity. We evaluate NODLINK in a production environment. The openworld experiment shows that NODLINK outperforms two state-ofthe- art (SOTA) online provenance analysis systems by achieving magnitudes higher detection and investigation accuracy while having the same or higher throughput. 

   more » « less