Modeling Cyber Situational Awareness Through Data Fusion Evan L
Total Page:16
File Type:pdf, Size:1020Kb
Air Force Institute of Technology AFIT Scholar Theses and Dissertations Student Graduate Works 3-21-2013 Modeling Cyber Situational Awareness through Data Fusion Evan L. Raulerson Follow this and additional works at: https://scholar.afit.edu/etd Part of the Digital Communications and Networking Commons Recommended Citation Raulerson, Evan L., "Modeling Cyber Situational Awareness through Data Fusion" (2013). Theses and Dissertations. 898. https://scholar.afit.edu/etd/898 This Thesis is brought to you for free and open access by the Student Graduate Works at AFIT Scholar. It has been accepted for inclusion in Theses and Dissertations by an authorized administrator of AFIT Scholar. For more information, please contact [email protected]. MODELING CYBER SITUATIONAL AWARENESS THROUGH DATA FUSION THESIS Evan L. Raulerson, Captain, USAF AFIT-ENG-13-M-41 DEPARTMENT OF THE AIR FORCE AIR UNIVERSITY AIR FORCE INSTITUTE OF TECHNOLOGY Wright-Patterson Air Force Base, Ohio DISTRIBUTION STATEMENT A. APPROVED FOR PUBLIC RELEASE; DISTRIBUTION UNLIMITED The views expressed in this thesis are those of the author and do not reflect the official policy or position of the United States Air Force, the Department of Defense, or the United States Government. This material is declared a work of the U.S. Government and is not subject to copyright protection in the United States. AFIT-ENG-13-M-41 MODELING CYBER SITUATIONAL AWARENESS THROUGH DATA FUSION THESIS Presented to the Faculty Department of Electrical and Computer Engineering Graduate School of Engineering and Management Air Force Institute of Technology Air University Air Education and Training Command in Partial Fulfillment of the Requirements for the Degree of Master of Science in Electrical Engineering Evan L. Raulerson, B.S.C.S. Captain, USAF March 2013 DISTRIBUTION STATEMENT A. APPROVED FOR PUBLIC RELEASE; DISTRIBUTION UNLIMITED AFIT-ENG-13-M-41 MODELING CYBER SITUATIONAL AWARENESS THROUGH DATA FUSION Evan L. Raulerson, B.S.C.S. Captain, USAF Approved: Kenneth Hopkinson, PhD (Chairman) Date Maj Kennard Laviers, PhD (Committee Member) Date Timothy Lacey, PhD (Committee Member) Date AFIT-ENG-13-M-41 Abstract Cyber attacks are compromising networks faster than administrators can respond. Network defenders are unable to become oriented with these attacks, determine the potential impacts, and assess the damages in a timely manner. Since the observations of network sensors are normally disjointed, analysis of the data is overwhelming and time is not spent efficiently. This time would be better used to determine and implement the best responses to network events to minimize damage. Automation in defending cyber networks requires a level of reasoning for adequate response. For the automated response systems that exist, they are mostly limited to scripted responses based on data from a single sensor. Better defense tools are required. For network administrators and automated decision- making agents to develop suitable response plans, they must know the correct and current information about the network. This research develops a system framework that aggregates data from heterogeneous network sensors, including intrusion detection systems, antivirus software, network mapping tools, and host monitoring software. The collected data is correlated into a single model that is easily interpreted by decision-making entities. This research proposes and tests an impact rating system that estimates the feasibility of an attack and its potential level of impact against the targeted network host as well the other hosts that reside on the network. The impact assessments would allow decision makers to prioritize attacks in real-time and attempt to mitigate the attacks in order of their estimated impact to the network. Additionally, this system provides the range of potential actions that an administrator would be allowed to perform on the network. For automated agents, the inclusion of the action set reduces the search space, allowing quicker results. The ultimate goal of this system is to provide computer network defense tools the situational awareness required to make the right decisions to mitigate cyber attacks in real-time. iv To my adoring wife and children. Thank you for supporting me every step of the way and for the sacrifices you made during this research. v Acknowledgments I would like to express my sincere appreciation to my wife. She always stood by me and gave me encouragement to overcome the stressful times. I am eternally grateful for her patience and inspiration. I am thankful to Captain James Hannan and Captain James Emge for helping test the output of my system. Since their research systems used the data produced from the tools that I built, they further drove my system’s requirements. Additionally, Captain Emge helped set up the test environment and the attack scenarios for the experiment. The feedback and assistance they gave me helped make my system more usable and easily interoperable with other systems. Finally, I would like to thank my advisor, Dr. Kenneth Hopkinson, and my committee, Dr. Timothy Lacey and Major Kennard Laviers. Their guidance and mentorship were invaluable during this research. Evan L. Raulerson vi Table of Contents Page Abstract......................................... iv Dedication........................................v Acknowledgments.................................... vi Table of Contents.................................... vii List of Figures...................................... xi List of Tables...................................... xiii List of Acronyms.................................... xiv I. Introduction.....................................1 1.1 Overview...................................1 1.2 Problem Statement..............................3 1.3 Goals and Approach.............................4 1.4 Contribution..................................4 1.5 Summary...................................5 II. Literature Review..................................6 2.1 Cyber Warfare.................................6 2.1.1 Cyber Attack Vectors.........................7 2.1.2 Cyber Defensive Maneuvers.....................8 2.1.3 Warfare decision making....................... 11 2.2 Gathering network information........................ 12 2.2.1 Detection mechanisms........................ 13 2.2.2 Vulnerability databases........................ 15 2.3 Cyber attack vectoring prediction....................... 16 2.3.1 State Modeling............................ 17 2.3.2 Attack Trees and Graphs....................... 19 2.4 Data Fusion.................................. 20 2.5 Intrusion Detection System (IDS) Alert Aggregation............ 25 2.6 Impact Assessments.............................. 26 2.7 Uses of Cyber Situational Awareness..................... 27 vii Page 2.7.1 Scripted Responses.......................... 27 2.7.2 Artificial Intelligence Systems.................... 28 2.8 Conclusion.................................. 30 III. System Design................................... 31 3.1 Overview................................... 31 3.2 Requirements................................. 32 3.3 Approach................................... 33 3.4 Design..................................... 33 3.4.1 System Framework.......................... 33 3.4.2 Data acquisition........................... 35 3.4.3 Sensors Selection........................... 36 3.4.3.1 Snort............................ 36 3.4.3.2 Nmap........................... 39 3.4.3.3 Host Monitoring...................... 40 3.4.3.4 Antivirus.......................... 40 3.5 Data repository................................ 41 3.5.1 Snort database............................ 41 3.5.2 PBNJ database............................ 43 3.5.3 Monitor database........................... 43 3.5.4 Vuln database............................. 45 3.6 Primary data orientation process....................... 46 3.7 Action set identification process....................... 48 3.7.1 Process Mechanics.......................... 48 3.7.2 Contribution of Action Set Identification.............. 50 3.8 Attack criticality classification process.................... 51 3.8.1 Process Mechanics.......................... 51 3.8.2 Rating System............................ 52 3.8.3 Contribution of Criticality Rating.................. 54 3.8.4 Example Execution of Criticality Assessment Process....... 54 3.8.5 CVSS Scores and Predicted Impacts................. 56 3.9 Modeler execution.............................. 63 3.10 Summary................................... 64 IV. Methodology.................................... 65 4.1 Introduction.................................. 65 4.1.1 Problem Statement.......................... 65 4.1.2 Goals and Hypothesis........................ 66 4.1.3 Approach............................... 67 4.2 System environment............................. 68 viii Page 4.3 Attack Traffic Selection............................ 72 4.3.1 BackTrack5 and Metasploit Framework............... 72 4.3.1.1 Network mapping and port scanning........... 72 4.3.1.2 Structured Query Language (SQL) injection....... 72 4.3.1.3 Operating System (OS) exploit.............. 73 4.3.1.4 Denial-of-Service (DoS).................. 73 4.3.1.5 Password guessing..................... 73 4.3.1.6 Mail Blitz......................... 73 4.3.1.7 Netcat connection..................... 74 4.4 Experiment Design.............................. 74 4.5 System Boundaries.............................. 75 4.5.1 Performance Metrics......................... 75 4.5.1.1 Data-to-Information Ratio