2013 2013 5th International Conference on Cyber Conflict PROCEEDINGS K. Podins, J. Stinissen, M. Maybaum (Eds.) 4-7 JUNE 2013, TALLINN, ESTONIA 2013 5TH INTERNATIONAL CONFERENCE ON CYBER CONFLICT (CYCON 2013) Copyright © 2013 by NATO CCD COE Publications. All rights reserved. IEEE Catalog Number: CFP1326N-PRT ISBN 13 (print): 978-9949-9211-4-0 ISBN 13 (pdf): 978-9949-9211-5-7 ISBN 13 (epub): 978-9949-9211-6-4 Copyright and Reprint Permissions No part of this publication may be reprinted, reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of the NATO Cooperative Cyber Defence Centre of Excellence ([email protected]). This restriction does not apply to making digital or hard copies of this publication for internal use within NATO, and for personal or educational use when for non-profit or non- commercial purposes, providing that copies bear this notice and a full citation on the first page as follows: [Article author(s)], [full article title] 2013 5th International Conference on Cyber Conflict K. Podins, J. Stinissen, M. Maybaum (Eds.) 2013 © NATO CCD COE Publications Printed copies of this publication are available from: NATO CCD COE Publications Filtri tee 12, 10132 Tallinn, Estonia Phone: +372 717 6800 Fax: +372 717 6308 E-mail: [email protected] Web: www.ccdcoe.org Layout: Marko Söönurm Legal Notice: This publication contains opinions of the respective authors only. They do not necessarily reflect the policy or the opinion of NATO CCD COE, NATO, or any agency or any government. NATO CCD COE may not be held responsible for any loss or harm arising from the use of information contained in this book and is not responsible for the content of the external sources, including external websites referenced in this publication. CYCON 2013 SPONSORS TECHNICAL SPONSOR DIAMOND SPONSOR GOLD SPONSORS SPONSOR ABOUT THE NATO CCD COE The NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE) is an international military organisation accredited in 2008 by NATO´s North Atlantic Council as a “Centre of Excellence”. Located in Tallinn, Estonia, the Centre is currently supported by Estonia, Germany, Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland, Slovakia, Spain, and the USA as Sponsoring Nations. The Centre is not part of NATO’s command or force structure, nor is it funded by NATO. However, it is part of a wider framework supporting NATO Command Arrangements. The NATO CCD COE’s mission is to enhance capability, cooperation and information-sharing between NATO, NATO member States and NATO’s partner countries in the area of cyber defence by virtue of research, education and consultation. The Centre has taken a NATO-orientated, interdisciplinary approach to its key activities, including academic research on selected topics relevant to the cyber domain from legal, policy, strategic, doctrinal and/ or technical perspectives, providing education and training, organising conferences, workshops and cyber defence exercises and offering consultations upon request. For more information on the NATO CCD COE, please visit the Centre’s website at http://www.ccdcoe.org. For information on Centres of Excellence, visit NATO’s website “Centres of Excellence” at http://www.nato.int/cps/en/natolive/topics_68372.htm. Foreword Cyber conflicts are increasingly moving towards an operational theatre, where physical and cyber space are becoming hardly distinguishable, where the surrounding cyber ecosystem is global, dynamic and involves tens of thousands networks, and where the sheer volume of cyber security incidents data that needs to be collected, analyzed and acted upon is staggering. In this ecosystem we are talking about monitoring tens of thousands of networks that connect hundreds of thousands, if not millions of devices. Consequently, it is becoming evident that we have to move from passive perimeter-bound cyber defense, where we have spent tremendous amounts of effort, time and money in protecting every single item along the perimeter of the cyber ecosystem, towards active cyber defense and offensive actions that secure resiliency of our cyber-kinetic operations, even in the presence of adversary attacks. Not less importantly, the paradigm of perimeter cyber defense leaves our cyber-kinetic operations vulnerable to insider attacks. The models of achieving resiliency of cyber-kinetic operations are still at active research and development stage, but several of them have proven their value, including self-organization and adaptation to evolving cyber security situations, prediction of potential adversary cyber attacks and other disruptive events before their occur, and recovery and restoration of operational capacities after the attacks. Whatever the future technology of resilient cyber-kinetic operations will emerge, it is undisputable fact that the center piece of this technology is automation of cyber security data analysis and decision-making processes that underlay defensive and offensive actions in cyber conflict. We look on automation not only as an enabling technological device to proceed with cyber conflict operations, but also extend its associated impact on the behavioral entities acting in strategic and legal space. In order to have a better chance of securing our mission critical information systems (and critical information infrastructure in general), we must make defenses smarter and more autonomous. However, while reducing the role of the human in the loop may provide benefits like quicker reaction time, better anomaly detection and a potential shift in strategic balance of power, it will also lead to new security challenges. Many of these challenges have a profound impact on the ethical, moral and legal aspects of cyber security, which can only be addressed in open-minded and multi-disciplinary discussions. Research and development of different automated procedures of supporting defensive and offensive cyber security operations have been conducted over a number of years, but mostly as independent isolated efforts, e.g. automatic alarm correlation procedures exploited in different intrusion detection systems, automatic vi vulnerability scanners, data mining techniques for generating patterns of new cyber attacks, expert systems advising IT personnel how to recover networks and systems after the impact of the cyber attack, machine learning and genetic algorithms to model the propagation of computer viruses and botnets, and others. The mission and vision of this conference is to look on automation of cyber conflict operations from synergistic multi-disciplinary perspective. The conference intention was to underscore the role of automation not just as enabling cyber security technology, but as a critical factor, which makes the future cyber defense and offense possible, and what kind of legal, social and moral implications we have to be concerned. In this context the annual Cyber Conflict (CyCon) conferences conducted yearly in Tallinn by the NATO Cooperative Cyber Defense Centre of Excellence are continuing to provide their unique perspective. This distinctiveness is marked by an innovative synergistic approach to the conceptual framework, architectures, processes and systems of cyber security and conflict. It holistically examines computer science and IT technologies, law, strategic and policy matters, military doctrine, social and economic concerns and human behavioral modeling with respect to cyber space. The proceedings of this 5th International Conference on Cyber Conflict 2013 (CyCon 2013) are collected in this volume. The 26 were selected by the conference program committee following a rigorous peer review process. The papers are spread across the legal, policy, strategic, and technical spectra of cyber conflict, specifically focusing on the issues of automation. They include sophisticated analyses of topics like offensive and defensive cyber activities, the concept of the cyber space, its legal and technical boundaries, and the fundamental notions of cyber attacks, cyber attackers, cyber conflict, and cyber warfare. This volume is arranged into five chapters. The first chapter, Cyber Space – Automatic Information Sharing and Access, discusses the models of organizing cyber security information into a ubiquitous smart space, where information can be shared by cooperative cyber defense parties, can be automatically aggregated, and can be accessed depending on the operational context. The second chapter, Attack Modeling – Washing Away the Borders between Cyber and Kinetic Attack, discusses important issues of modeling cyber attacks, looks on limits of automatically generated cyber attacks, and explores new paradigms of cyber attacks, which directly impact entities and processes in the kinetic (physical) world. The third chapter, Cyber Attack Threat Assessment and Impact propagation is devoted to a wide spectrum of technical and legal issues associated with the analysis of the threat and impact of cyber attacks. The fourth chapter, Cyber Command – Towards Automatic Operations, collects number of papers that examine automatic procedures of tactical cyberspace operations, algorithms of detecting complex cyber attacks by automatic correlations of intrusion alerts from multiple sources, and novel architectures of building autonomic (automatic and autonomous) cyber vii security decision-making processes. The final chapter, Cyber Conflict - Politics, Semantics, Ethics and Moral,