**OAK RIDGE NATIONAL LABORATORY**

Center for Engineering Science Advanced Research (CESAR)

**Asynchronous Networks: Cyber -- Attack Source Identification**

*Nageswara Rao and Jacob Barhen (CESAR POC)*

*Science:* Cyber attacks are often hard to diagnose even when detected
at the hosts by Intrusion Detection Systems (IDS) because the source
information in the Internet Protocol (IP) packets is spoofed by either
explicitly storing wrong information or by re-routing the attacks via
proxy or zombie machines. By designing and installing packet "sniffing
sensors" at various strategic points in the network, one can collect
vital propagation information about the attack packets. Our methodology
fuses the sensor information together with the network profile to trace
the propagation paths of the attacks. This path information needs to be
further refined to isolate the origins of attack. We use sensors on a
subnet to identify the attacks from within or outside the subnet. By
exploiting the physical propagation of attack packets, the cyber-attack
source identification can be formulated as a graph-theoretic problem,
for which algorithms with optimal complexity and rigorous correctness
can be developed. Additional fundamental research is also needed to
address issues such as emerging computational chaos, which arises as
result of the concurrent asynchronous behavior of distributed algorithms
on such networks.

*Relevance to Counter Terrorism:* Cyber-attacks are on the increase over
the past few years together with the nature and amount of damage they
cause to the victims. The attacks are becoming increasingly
sophisticated in their capability and stealth, and at the same time,
they are becoming easier to use. At present, cyber-attacks can
potentially cripple the information infrastructure of the country by
attacking the power grids, airline information, and defense networks.
Such attacks can be launched from almost anywhere in the world with
potentially dire consequences. The ability to diagnose the sources of
such attacks will enable us to take corrective actions by actively
configuring the firewalls. For example, consider a distributed
denial-of-service attack orchestrated by a group of terrorists from
various locations around the world to cripple the defense network by
flooding the critical routes with junk traffic. The attacks can be
detected at the hosts by the IDSs, and the corrective actions can be
taken incrementally from the hosts all they way to the borders of the
network, thereby neutralizing the attack.

**Figure:** Asynchronous network under distributed cyber attack.

**Funding Profiles:** Asynchronous Networks: Cyber-Attack Source
Identification

Basic research related to multisensor information fusion and
asynchronous network dynamics funded by DOE/SC under the BES Engineering
Science (Intelligent Systems program). Application to cyber attack
funded by DOE/IN and by DARPA.

  ----------------------- ----------------------- -----------------------
                          **Total funding**       **Total BES funding**

  **FY 2001**             \$ 350,000              \$ 100,000

  **FY 2002**             \$ 400,000              \$ 100,000

  **FY 2003**             \$ 450,000              \$ 0
  ----------------------- ----------------------- -----------------------