# Presentation: 882234

## National Intelligence Community Information Assurance Research Program

**NICIAR: Pursuing Disruptive Technologies for Information Assurance**
**Carl E. Landwehr**
**Program Manager, NICIAR**

***The Overall Classification of this Briefing is***
**UNCLASSIFIED**

- Carl Landwehr
- NICIAR Program Manager
- 301-226-9108
- 265-5188(s)
- email: CLandwehr@casl.umd.edu

## The Nation’s Intelligence Community

**New DNI, Mike McConnell: **
** ****Intelligence Community Integration**
** ****Acquisition emphasis**
** ****Information sharing: **
**Need to know vs. responsibility to provide**
** ****Analyst at the center: **
**Know the customer needs**
**Know the sensors and source**

## What is “disruptive technology?

**Technology that precipitates change**

**Examples:**
** ****Digital vs. chemical photography**
** ****Packet vs. circuit communications**
** ****Wireless vs. wired telephony**

## Research Areas

**National Intelligence Community Information Assurance Research**

**Information Exploitation**

**Quantum Information Science and Technology**

**Exploratory**
**Investigations**

**Research Development and Experimental Collaboration (RDEC)**

## National Intelligence Community Information Assurance Research Program

**Vision:**
**Level the cybersecurity playing field**
**Dramatically improve the fundamental trustworthiness of the NIC cyber infrastructure**
**Defend existing NIC cyber infrastructure from external and internal threats; enable operation despite attacks**
**Goals:**
**Use accountability as a lever to reduce vulnerabilities and foster information sharing**
**Increase the attacker’s cost to penetrate NIC systems**
**Provide usable and flexible security mechanisms**

**Defense has an uphill battle!**

**Notes:**
Attackers range from hackers to organized terrorists groups on to nation-state intelligence organizations on many federal government intranets as well as the Internet.  These attackers are becoming more skillful at hiding data, their identities, addresses, and transactions associated with their penetrations into sensitive information systems, which in turn increases the risk to the information security.  To aggressively address the threats, it is necessary to explore and develop cutting-edge technologies that can provide capabilities to subvert our adversaries’ sophisticated attempts to penetrate the IC networks.

Cyber Situational Awareness
Cyber defenders must analyze and make sense of large volumes of data generated by a myriad of sensors and network management systems.   DTO seeks innovative technologies to help cyber defenders deconflict, correlate and understand large volumes of sensor data while displaying this information in a manner that best fits the cognitive processes used by the analyst or decision maker.

Cyber Indications & Warning
Today’s information assurance paradigm is a largely reactive model in that it focuses on detection of attacks once they are already underway. DTO seeks to significantly increase the warning time for an attack and provide defenders with a larger response window by creating proactive and predictive techniques that detect attack observables early in the attack sequence and prior to the modification of data or the exfiltration of sensitive information. 

Insider Threat Mitigation
The malicious insider is one of the greatest threats to the information assets of the IC. A trusted user who abuses computer privileges for traitorous ends can compromise classified information on a massive scale with potentially catastrophic results. DTO seeks to mitigate this threat through the creation of cyber solutions for modeling, detecting and preventing malicious insider behavior within IC systems and networks.

Attack Mitigation & Traceback
Adversaries are becoming increasingly sophisticated in their ability to disguise the true origin of an attack and the complete path taken to a victim.  DTO seeks advanced technologies that can rapidly and accurately attribute a cyber attack to its logical source, despite the presence of multiple disparate and non-cooperative and/or hostile networks, or attacker obfuscation techniques such as encryption, stepping stones, packet padding, or traffic timing manipulation.

Malicious Code Risk Mitigation
Malicious software represents an increasing threat to IC systems and networks as adversaries continue to achieve greater sophistication in techniques for hiding their presence and associated activity. DTO seeks to mitigate this threat with advanced tools to detect, contain, and eradicate “next generation” malicious software that threatens to infect an IC system sometime during its life cycle.

Secure Information Sharing
The operational needs of the IC demand more efficient techniques for determining which mission-critical information can be shared across domains of different sensitivity levels. DTO seeks automated tools that provide the human reviewer real-time support in making policy-based downgrade or release decisions.

## NICIAR Research Topics

## NICECAP Planned Timeline

**1    2    3     4     5    6     7    8     9   10  11   12    1     2    3    4     5    6     7    8     9   10   11  12   1 **

**BAA release 4/24/06**

**White papers due 5/23**

**Proposals invited 8/1**

**Proposal evaluation begins 9/5**

**Phase I Work begins 5/1**

**Contract negotiations begin 11/1**

**Packages ready for award 1/15**

**Topic areas:**
**Accountable Information flow**
**Large scale system defense**

## Potential Goals to Motivate Metrics

**Double**** ****attacker’s time/resource cost**** to compromise NIC systems through remote exploits**
**Unmodified system as baseline**
**Applications: reduce vulnerability windows in time (patch generation/installation, reconfiguration) and space (flaw/fault detection and removal)**
**Decrease by half**** the time and effort required to attribute a specific computational event/information flow to a (human/software/hardware) initiator**
**Unmodified system as baseline**
**Applications: sanitization, information sharing (credit), leakage (blame)**
**Stretch goal: ****Reduce by a factor of 10**** the time/effort required to certify/accredit a new, conforming software component for use in a general purpose environment based on accountable information flow technologies**
**Existing system and certification/accreditation process as baseline**

## Large Scale System DefenseS. Bellovin, A. Keromytis, S. Stolfo, Columbia U.

- PROBLEM:   Scalable Automated Collaborative Defenses
- Solution: **  Artificially diversified detectors/software**
*Leverage monocultures into distributed sensor net*
**Automated learning-based anomaly detectors**
**Automated patch generation**: faster response
**Better Patch Management: safe deployment**

**PROGRESS**
**Source code patching tool - DYBOC**
- Stack and heap-based buffer overflow and underflow attacks
**Emulator-based ISR - STEM**
- New content-based anomaly detector  - Anagram
- Experimental evaluation with R2
**Data sanitization**
- Model normal “attack-free” traffic
- DNAD-2: (formerly called Worminator/Whirlpool)
- Content-centric Distribution System (sensor independent)
- Source IP’s of detected attacks *e.g.* Snort IDS alerts
- Aggregation of IDS alerts & reports
- Patches

***LSSD***

## ConfigAssure: Dynamic System Configuration Assurance for NIC Cyber Infrastructure, S. Narain et. al., Telcordia / S. Malik, Princeton / D. Jackson, MIT

**PLAN**
**Design ConfigAssure Architecture. (Nov 2007)**
**Develop prototype and integrate Zchaff and Kodkod technologies developed by Princeton and MIT (May 2007)**
**Conduct evaluations and trials (August 2008)**

**APPROACH**
**Specify security architecture via first-order logic constraints on component configurations.**
**Use constraint solver  to compute (a) component configurations implementing security architecture, and (b) plan to safely evolve to new configuration **
**Adapt infrastructure to preserve security architecture in response to contingencies**

***LSSD***

**ConfigAssure System Architecture**

- Requirement Solver

- Components

- Security Architecture

- New Configurations & Reconfiguration Plan

- Adaptation Policy Engine

- Contingencies

- Infrastructure components

- ConfigAssure automates configuration of large systems

- SAT
- Solver

- Com-
- piler

- New Configurations &
- Reconfiguration Plan

- Boolean
- constraints

- Components To Be Configured

- Security Architecture
- in FOL

- Decom-
- piler

- Solution

## Software Diversity via Context-Free Grammar Transformations – Gerald Thompson, Lucent Technologies

**Create functionally equivalent copies of an executable that are diverse with respect to:**
**number of functions**
**function parameters**
**stack and heap variables**
**Generate a context-free grammar from a program, perform random transformation on the grammar, then construct a new program from the transformed grammar**
**Variant code will be robust against attacks that depend on knowledge of program structure**

***LSSD***

## Software Exploit Prevention and Remediation via Software Memory Protection,  Coleman, Davidson, Evans,Knight,Nguyen-Tuong, U. Virginia

**APPROACH**
**Develop a unique single security mechanism that can defend against memory corruption exploits**
**Provide mechanisms for remediation, including diagonostics, recovery and repair.**
**Make generalized defense practical by keeping run time performance penalities small and making protections easily portable and scaleable.**

**PLAN**
**Demonstrate ability to identify critical data and untrusted operations in binaries (Nov 2007)**
**Demonstrate integrated policies using output of analysis phase (Jan 2008)**
**Demonstrate additional policies (May 2008)**
**Final prototype and supporting documentation (August 2008)**

***LSSD***

## IFERRET: Improving Program Security through Traceable Dynamic Information Flow T. Leek, G. Baker, R. Lippmann MIT-Lincoln Lab

**Developers / security experts given ability to **
** ****Monitor progress of sensitive and malicious information through and between programs**
** ****Monitor many sources, allowing for more comprehensive security policies**
** ****Ask, when a buffer overflow is about to happen, “Which parts of which inputs are responsible?”**
** ****Ask, of a debugger, “What input bytes control this variable?” **

**IFERRET: Traceable Dynamic Information Flow System**
**System-wide**
**Traceback: Permits tracing any byte in memory back to parts of inputs from which it derives**
**Unlimited sources**
**Memory efficient: much less than one bit per byte**
**Implicit Information Flow (IIF)**

**PLAN (through 8/08)**
**Build IFERRET prototype, leveraging existing Taint Graph implementation**
**Evaluate**
** ****Track passwords from multiple sources**
** ****Track multiple local IP addresses**
** ****Trace back malicious input to one source among many  **
** ****Measure miss and false alarm rates, overhead**

***LSSD***

## Orchestra: Leveraging Parallel Hardware to Detect, Quarantine, and Repair Malicious Code Injection, M. Franz, UC-Irvine

**APPROACH**
** ****Develop a multi-variant code execution technique that will detect injected malware in real time and automatically repair affected code.**
** ****Execute several slightly different instances of the same program in lockstep on multiple disjoint h/w processing elements**
** ****Uses system call randomization for code diversity**
** ****A monitoring layer compares the computation states of the different instances and flags differences as suspect.**
** ****Raises the cost of attacking a system by forcing an intruder to devise a different attack vector for each specific instance of a program.**

**PLAN**
** ****Initial Prototype, Aug 07**
** ****Add variable addressing diversity, Dec 07**
** ****Expand the scope of diversity to system libraries, Nov 07**
** ****Refined prototype, Feb 08**
** ****Add application binary interface diversity, May 08**
** ****Expand scope to the operating system, May 08**
** ****Results from hardware support study, Jul 08**
** ****Final prototype, Jul 08**

***Orchestra: Leveraging Parallel Hardware to Detect, Quarantine, and Repair Malicious Code Injection, M. Franz, UC-Irvine***

***LSSD***

**Core 1**
**(e.g.,stack **
**grows**
** ****up)**

**Core 2**
**(e.g.,stack **
**grows**
** ****down)**

**Checkpoints**

**Multi-core processor**

## Process Coloring For Malware Investigation, D. Yu, E. Spafford, Purdue / X. Jiang, GMU

**APPROACH**
**Track OS-level information flow provenance by assigning a unique identifier (color) to each potential malware entry point**
**Color individual processes/data based on their interaction with potential entry points or other previously colored processes/data**
**Color-based identification of malware contaminations**
**Color-based reduction of log data to be analyzed**
**Highlight event anomalies via abnormal color interactions present in logs**
**Leverage virtual machine technology for tamper resistance of log coloring**

**PLAN**
**Formal model of process (color) provenance for OS level flows, Jul 07**
**Demonstrate a process coloring prototype in a malware scenario, Jul 08**
**Includes both server and client side solutions**
**Evaluate the effects of color diffusion and mixing on malware warning and detection, including:**
**Profiling and visualization, Dec 08**
**Reducing false positives caused by legitimate color mixing, Mar 08**
**Tracking cross-border color mixing, Jul 08**
**Deploy in a real-world environment, Feb 08 – Jul 08**

***Process Coloring For Malware Investigation, ******D. Yu, E. Spafford, Purdue / X. Jiang, GMU***

***LSSD***

## 100 Mb/sec for 100 Million Households:  A Clean Slate Design for the Internet,  S. Fraser, Fraser Research

**Current Approach**

**Security an ad-hoc overlay**
**Mobility a late addition**
**Dumb network, smart host**

- FILES

- NETWORK

- NIU

- root

- trunk

- LAN

- access

- backbone

- host

- regional

- center

- agent

- physical layer

- logical layer

- P2. Main forwarding path

- P3. Host interface and signaling

- P4. Architecture testbed

**Privacy****	****Access control for all conversations****	**
**	****Authenticated endpoints**
**Robust secure   Rapid and automatic service restoration**
**service ****	****      Infrastructure with multiple layers of defense**
**Universal ****	****  Unification of wired, wireless and satellite**
**mobility ****	****  Every service, host and network can be mobile**
**Independent  A new host/network interface with signaling**
**evolution ****	****  Extensible range of network styles and services**
**	****	**
**Incremental ****	****  Consistent with existing premises hardware**
**deployment ****	****  Small initial change to host software**

***AIF***

**New Approach**

** ****Security from the ground up**
** ****Mobility an initial consideration**
** ****Smart network, independent host**

## Designing Secure Networks from the Ground Up (SANE)N. McKeown, et.al. Stanford, S. Akella UW-Madison 

***Designing Secure Networks from the Ground Up (SANE)******N. McKeown, et.al. Stanford, S. Akella UW-Madison****** ***

- Ask the question: Starting with a clean-slate, how can we design Public and Private networks to be inherently secure from the ground up?
- Force the _origin_ and _intent_ of traffic to be explicit
- Private Networks:
- SANE: All network connectivity governed by global policy; Implement secure namespace
- Ethane: Ethernet-compatible prototype; Domain Controller and custom Ethernet switch.
- Public Networks: Work yet to start
- Technology Transition
- Deploying at Stanford, UW-Madison and other research groups
- Expect to work with commercial partners to transfer technology

- Technical Results
- Ethane prototype deployed in research group at Stanford
- Software switch & Domain Controller implemented
- Hardware switch defined

- Domain
- Controller

- 1. Authenticate user

- Nick

- Martin

- Public Internet

- 2. First data packet

- 3. Install path

- 4. Data

- Ethane: v1.0

- Ethane: Local Deployment

- Q4 06

- Q1 07

- Q2 07

- Q3 07

- Q4 07

- Ethane: Remote Deployment

- Ethane: v2.0

- inSANE: Invention

- inSANE: v1.0

- We make no commitment to keep to this schedule and will change it
- as the research dictates

***AIF***

## Data Flow Analysis for Information Accountability and Security Enforcement, Jeremy Price, SWRI and Calvin Lin, UT Austin

**APPROACH**
**Combine static analysis and runtime monitoring techniques to enhance the trustworthiness of applications**
**Detect vulnerabilities and automatically repair the affected application**
**Employ an annotation language to define security properties independent of any programming language**
**Statically identify potential violations in code**
**Insert runtime monitoring code into untrusted software**

**PLAN**
** ****Mid-term demonstration prototype kit, 9 months ARO**
** ****Mid-Term Research Claims Evaluation Report****, 9 months ARO**
** ****Preliminary DDFA Design Document****, 12 months ARO**
** ****Final demonstration prototype kit, 18 months ARO**
** ****Final DDFA Design Document, 18 months ARO**
** ****Final report, 18 months ARO**

- New Start

***AIF***

## Physical Unclonable Functions and Secure Processors, Srinivas Devadas, PUFCO Inc.

**APPROACH**
**Build a secure processor based on inherent and unique chip delays to generate physically unclonable and tamper resistant secrets as a foundation for accountable information flow. **

**PLAN**
**PUF enabled secure processor design and specification document (month 4)**
**ASIC Implementation (month 12)**
**Application Demonstration and Evaluation results (month 18)**

***AIF***

## Nexus Operating System for Trustworthy Computing Fred Schneider, E Gün Sirer, Cornell University

**APPROACH**
**Develop a next generation operating system infrastructure based on the concept of active attestation.**
**Demonstrate that creation and use of a new generalized form of attribution certificates can reliably associate execution guarantees with specified software components.  **

**PLAN**
**Complete stand alone infrastructure (3 months)**
**Prototype active attestation of certification without assumptions. (6 months)**
**Implement introspection service (9 months)**
**Build applications using active attestation (12 months)**
**Implement an example network reference monitor (15 months)**

***AIF***

## Accountability for Information Flow via Explicit Formal Proof, F. Pfenning et. al., CMU / B. Witten, Symantec

**APPROACH**
**Develop novel logical techniques that capture both authorization and information flow in systems**
**Show that these techniques can be integrated into systems to enforce these requirements for real applications**
**Develop: relevant policies**
**Foundations for logics of affirmation and knowledge**
**File system prototype**

**PLAN**
**Specification of access control policies modeled after an Intelligence Community organization, Feb 08**
**Formal logic, associated logic properties, and proof checker, Feb 08**
**Demonstrate a proof-carrying authorization (PCA) prototype for creating and verifying proofs of access control in a selected file system, Jul 08**

***Accountability for Information Flow via Explicit Formal Proof, F. Pfenning et. al., CMU / B. Witten, Symantec***

***AIF***

**fopen (“memo.txt”)**

- Prove: **root says read**

- Proof: **... root s****a****ys ...****... delegate (root, Alice, read(“memo.txt”))**** ...**

**pubkey_root: { delegate (root, Alice, read(“memo.txt”) }**

- memo.txt

## Trust Management Intrusion-tolerance, Accountability, and Reconstitution Architecture, (TIARA) H. Shrobe et. al., MIT / A. DeHon, Penn

**APPROACH**
**Provide for fine-grained tracking of data security context, non-bypassable enforcement of security policies, and application data provenance tracking.**
**Use hardware based tag processing unit to support a broad range of access control and information flow models.**** **

**Develop TIARA FPGA based hardware to ensure integrity of the memory structuring conventions and implement secure information flow. (Month 12)**
**Develop TIARA software layers that enforce structuring constraints, access controls and data accountability  (Month 12) **
**Conduct active briefing book based demonstration. (Month 15) **

***AIF***

## System Wide Information Flow Enforcement T. Jaeger & Patrick McDaniel, Penn State

**APPROACH**
**Develop practical information flow enforcement semantics **
**Build application level enforcement of system information flow requirements**
**Enforce and convey system information flow requirements **
**Leverage virtual machine technology to simplify information flow integrity**

**PLAN**
**Extend SELinux Labeled IPSEC mechanism to convey requisite security information (Month 8)**
**Build Xen virtual infrastructure to enable verification of loaded software. (Month 14)**
**Build a JIF based web browser that ensures secrecy and integrity of information flows (Month 15)**
**Conduct functional tests and vulnerability analysis (Month 17)**

***AIF***

- Provide Information flow guarantees via VMMs (e.g.,Xen/sHype) and applications (e.g., security typed languages)

## End-to-End Semantic Accountability, D. Weitzner et.al.,MIT / J. Feigenbaum, Yale / J. Hendler RPI

**APPROACH**
**Access control through proof carrying authentication with access policies expressed over data semantics**
***Transparent***** data usage logging for real-time compliance hints and *****a posteriori***** *****accountability***
**Engineered as Web architecture components**

***End-to-End Semantic Accountability, ******D. Weitzner et.al.,MIT / J. Feigenbaum, Yale / J. Hendler RPI***

***AIF***

**PLAN**
**Scenario descriptions, May 07**
**Data purpose algebra specification, Jun 07**
**Appliance design and initial prototype, Sep 07**
**Prototype appliances:**
**Apache module, Nov 07**
**Client-side proxy, Dec 07**
**Accountability browser, Feb 08**
**Final accountability prototype, Feb 08**
**Final evaluation, Jun 08**

**GOAL: Provide robust social and technical basis for trusting that Web-scale information systems are being used in accordance with the rules set out for them, where rules are expressed with reference to the semantics of the information under control.**

## Thank You!Questions?

- Carl Landwehr
- NICIAR Program Manager
- 301-226-9108
- 265-5188(s)
- email: CLandwehr@casl.umd.edu

**Notes:**
 Current IC information infrastructure protections are like brick walls and paper bags. The paper bags have known holes in them and we are working on technology to help automate the monitoring of the attacks coming through the known holes and figure out whose fingers are reaching in.  We also have some brick walls. They provide effective security but also isolate people and work against effective sharing.  

## Backup Slides

**BACKUP Slides **
**covering past and transitioning research areas**

## Additional NICIAR Research

**Past research and ongoing transition efforts in**
**Insider Threat Mitigation**
**Malware detection (data sets available)**
**Cyber Situational Awareness**
**Fusing IDS alerts (data sets available)**
**Visualization of cyber situation data**
**IP Traceback**

## NICIAR Research Topics

_**Insider Threat Mitigation**_

**Goals:**
**Understand, characterize risk indicators**
**Detect suspicious insider workflows**
**Determine information provenance**

**Technologies:**
**Semantic discovery, relationship mining**
**Derivative text identification**
**Workflow process modeling and recognition**

_**Malicious Code Risk Mitigation**_

**Goals:**
**Detect malware in “passive” data**
**Test and deploy new countermeasures**

**Technologies:**
**Statistical content analysis**
**Machine learning**

**Notes:**
Insider Threat Mitigation
The malicious insider is one of the greatest threats to the information assets of the IC. A trusted user who abuses computer privileges for traitorous ends can compromise classified information on a massive scale with potentially catastrophic results. DTO seeks to mitigate this threat through the creation of cyber solutions for modeling, detecting and preventing malicious insider behavior within IC systems and networks.

Attack Mitigation & Traceback
Adversaries are becoming increasingly sophisticated in their ability to disguise the true origin of an attack and the complete path taken to a victim.  DTO seeks advanced technologies that can rapidly and accurately attribute a cyber attack to its logical source, despite the presence of multiple disparate and non-cooperative and/or hostile networks, or attacker obfuscation techniques such as encryption, stepping stones, packet padding, or traffic timing manipulation.

(Goals from (C) Quad Chart, but not from a labeled paragraph, Artwork from UNCL tri-fold).

## NICIAR Research Topics

_**Cyber Situational Awareness**_

**Goals:**
**Decision support tools that normalize, deconflict, correlate & interpret large volumes of data**
**Exploit human pattern recognition abilities in IA situation displays**

**Technologies:**
**Machine learning, automated deduction, abduction, visualization, **

_**Attack Attribution & Traceback**_

**Goals:**
**Identify true source of an attack**
**Overcome attacker obfuscation techniques**
**Reduce analysis complexity by enabling integration of tools & results**

**Technologies:**
**Timing-based packet watermarking**
**Correlation of packet flows**

**Notes:**
Cyber Situational Awareness
Cyber defenders must analyze and make sense of large volumes of data generated by a myriad of sensors and network management systems.   DTO seeks innovative technologies to help cyber defenders deconflict, correlate and understand large volumes of sensor data while displaying this information in a manner that best fits the cognitive processes used by the analyst or decision maker.

Cyber Indications & Warning
Today’s information assurance paradigm is a largely reactive model in that it focuses on detection of attacks once they are already underway. DTO seeks to significantly increase the warning time for an attack and provide defenders with a larger response window by creating proactive and predictive techniques that detect attack observables early in the attack sequence and prior to the modification of data or the exfiltration of sensitive information. 

(Goals from UNCL//FOUO Quad Chart, Artwork from UNCL tri-fold).

## IP Traceback Research Summary

**DTO research areas in attack traceback:**
**digital watermarking**
**traffic flow steering and timing analysis**
**passive monitoring**
**forensics for traceback**
**monitor placement and flow correlation**
**Research funding through mid FY07; looking for transition opportunities**

## Traceback:  The Landscape

**Attacks begin with an *****originating host***
**Traffic may pass through through various *****stepping stone***** hosts **
**A *****controller***** might control a number of *****zombie***** hosts that have malicious software implanted within them (most often without their knowledge or consent).  **
**Zombies may attack one or more *****target***** machines, to perform either a denial of service attack or to modify or exfiltrate information from them. **
**Exfiltrated information may go to a *****receiver***** host that, in turn, is separated from the originating host by a series of stepping stone machines**