Real-time recovery of compromised information

An apparatus and a corresponding method provide for real-time recovery of compromised information in a computer network. The method includes analyzing data objects in the computer network to determine data objects that comprise minimal essential information, collecting the minimal essential information, and storing the minimal essential information. To limit potential exposure of the minimal essential information, the stored minimal essential information is hidden in the computer network.

TECHNICAL FIELD

The technical field is systems and processes designed to protect the security of computer information, and restore access to compromised information.

BACKGROUND

A personal computer and a modem access to the Internet are all the tools that a computer hacker needs to conduct a cyber attack on a computer system. The rapid growth of a computer-literate population provides millions of people the opportunity to possess the skills necessary to conduct a cyber attack. The computer literate population includes recreational hackers who attempt to gain unauthorized electronic access to information and communication systems. These computer hackers are often motivated only by personal fascination with hacking as an interesting game. Criminals, and perhaps organized crime, might also attempt personal financial gain through manipulation of financial or credit accounts or stealing services. Industrial espionage can also be the reason for a cyber attack on a competitor's computer system. Terrorists may attempt to use the computer infrastructure. Other countries may use the computer infrastructure for national intelligence purpose. Finally, there is the prospect of information warfare, which is a broad, orchestrated attempt to disrupt a United States military operation, critical infrastructure(s), or significant economic activity.

A typical secure computer network has an interface for receiving and transmitting data between the secure network and computers outside the secure network. The interface may be a modem or an Internet Protocol (IP) router. Data received by the modem passes through a firewall, which is a network security device that only allows data packets from a trusted computer to be routed to specific addresses within the secure computer network. Although the typical firewall is adequate to prevent outsiders from accessing a secure network, hackers and others can often breach a firewall. An entry by an unauthorized user into the secure computer network, past the firewall, from outside the secure computer network is an intrusion. As can be appreciated, new ways of overcoming the security devices are developed every day.

Another type of unauthorized operation is insider misuse, which is an unauthorized access from a computer within the secure computer network. In insider misuse, the firewall is not breached. Instead, the unauthorized operation occurs from inside the secure computer network. For example, an unauthorized user could obtain the password of all authorized user, logon to the secure computer network from the authorized user's computer, and attempt to perform operations not typically associated with the authorized user.

Security and intrusion detection systems exist that can determine if very specific and well known types of breaches of computer security are occurring. These computer security systems passively collect audit information from network devices and format those audits for later review. Known attack signatures can be identified, but new attacks cause these systems significant problems since the identification of a new attack often needs to have human intervention and assistance. Furthermore these computer security systems do not take steps to stop the misuse or intrusion after it is detected. Security systems that do take active steps are limited to logging a user off the network, stopping communications with that computer, halting operations and shutting down and restarting the computer system, and notifying security personnel of the breach, often by e-mail message.

Once an intruder gains access to information on the secure computer network, the intruder can compromise information on the network such that an extensive recovery process will be required if all the compromised information is to be recovered. For example, if the secure computer network is subjected to an information warfare (IW) attack, then restoration of the secure computer network to full operational capability may involve shutdown of the secure computer network, and a time-consuming restart. Intruders may be able to take advantage of the down-time associated with recovery by physically attacking assets associated with the secure computer network. Existing computer security systems are not capable of rapidly returning a compromised secure computer network to even a minimal level of operation, let alone to full operational capability.

SUMMARY

What is disclosed is method for real-time recovery of compromised information in a computer network. The computer network includes nodes arranged into subnets, with the subnets forming the computer network. The method includes the steps of analyzing data objects in the computer network to determine data objects that comprise minimal essential information, collecting the minimal essential information, and storing the minimal essential information, wherein the stored minimal essential information is hidden in the computer network.

In another aspect, what is disclosed is method for recovering a computer network following an information warfare attack, including, prior to the attack, determining minimal essential information to establish operation of the computer network following the attack, collecting the minimal essential information, and hiding the minimal essential information in the computer network to lessen susceptibility of the minimal essential information to the attack.

In yet another aspect, what is disclosed is a system for recovery of a computer network subject to an information warfare attack. The system includes an agent manager that identifies data objects existing on the computer network, a service manager that determines data objects that are constants, and an application manager that determines a hierarchy of modes of operation of the computer network. Also included are a data analyzer that determines minimal essential information based on the identified data objects, and a recovery manager that collects and stores the minimal essential information, and that uses the minimal essential information to recovery the computer network subsequent to the information warfare attack.

DETAILED DESCRIPTION

Many distributed computer system networks are subject to an information warfare (IW) attack and compromise of information.FIG. 1illustrates a network, configured as a local area network (LAN)100, which may be subject to IW attack. The LAN100includes multiple network devices101, which are located at nodes on the network100. The devices101are linked by links102into subnets103, and a series of the subnets103forms the LAN100. The devices101may be local client processors, such as servers and personal computers, for example. The network100may be an ARCnet, an Ethernet, and a Token-Ring network. The links102in the network100may be of any known physical configuration including unshielded twisted pair (UTP) wire, coaxial cable, shielded twisted pair wire, fiber optic cable, for example. Alternatively, the links103may be wireless links. The LAN100may also include dial-up remote access using a modem105to a remote client107, and a dedicated port109to a remote client107′.

FIG. 2Ais a diagram of a portion100′ of the LAN100showing specific features related to security and recovery of compromised information. The LAN portion100′ includes, as network devices101, a network database server104, a database106, a host computer108, a terminal110, and a computer system112. Each network device104,106,108,110,112can also be considered a node because each network device has an addressable interface on the LAN100. As can be appreciated, many other devices can be coupled to the LAN100including personal computers, servers, mini-mainframe computers, mainframe computers, and other devices not illustrated or described, but which are well known in the art.

Also shown is security server114for implementing intrusion detection, suppression, coutermeasures, and recovery from IW attack. A firewall116connects the LAN portion100′ to an interface118. The firewall116is a combination hardware and software buffer that is between the LAN portion100′ and external devices outside the LAN portion100′. The network devices101within the LAN portion100′ appear within the dashed lines inFIG. 2A, and external devices outside the LAN portion100′ appear outside the dashed lines inFIG. 2A. The firewall116allows only specific kinds of messages from external devices to flow in and out of the LAN portion100′. As is known in the art, firewalls are used to protect networks such as the LAN100from intruders or hackers who might try to break into the LAN100. The interface118is external to the LAN100and can be a modem or an Internet Protocol (IP) router, for example. The interface118serves to connect the LAN100to devices outside the LAN100. For illustrative purposes, an intruder computer system is shown at130.

Finally,FIG. 2Ashows a radar system120that may be used to track airborne targets. The radar system120includes means for detecting targets, means for displaying target information to a human operator, and means for tracking, analyzing, and classifying targets. These means may include means for alerting human operators when a threat target is detected and classified, as well as means for initiating defensive measures, such as initializing air defense systems (not shown).

FIG. 2Bis a simplified block diagram of the radar system120. The radar system120includes an antenna121, a transmitter123, and a receiver124, with the transmitter123and the receiver124coupled to the antenna121by a duplex switch122. The radar system120also includes a processor126that receives data from the receiver124, a synchronizer127that controls transmissions, and a display128that displays information related to transmissions and target detections. Finally, a power supply129provides power to components of the radar system120.

The antenna121takes a radar pulse from the transmitter123and puts the pulse into the air. Besides focusing the energy of the radar pulse into a well-defines beam, the antenna121must keep track of its own orientation, which can be accomplished by the synchronizer127. In some radar systems, the antenna does not actually move, but the radar pulse is steered electronically, in which case the orientation of the radar beam is known a priori.

The transmitter123creates radio waves, and modulates the radio waves to form the radar pulse. The transmitter123also amplifies the signal to a high power to provide for an adequate detection range. The receiver124receives a return signal from a target. The receiver's ability to discern a received signal from a target from background depends on signal to noise ratio (S/N, or SNR). In the receiver124, the SNR sets a threshold for detection that determines what will be displayed, and what will not be displayed. If the SNR is set too high, then the radar system120will experience few false alarms, but some actual targets may not be displayed. The receiver124may monitor background noise and adjust the SNR to maintain a constant false alarm rate. The receiver124includes several other parameter that determine performance of the radar system120. One such parameter is fast time constant (FTC). FTC is intended to reduce the effect of long duration events such as rain, for example. Since rain occurs over an extended area, rain will produce a long, steady return. The FTC allows only return signals with a rapid rise and fall to be displayed.

The display128may be designed to provide visual information to a human operator. The most common display format is a plan position indicator (PPI) display, which is a circular, top down view of the area swept out by the radar system120, with the antenna121at the center of the display. On the PPI display, target range is represented by the distance from the center of the display outward, and bearing is indicated by angular displacement from a reference point (usually “noon”).

FIG. 3is a block diagram illustrating an exemplary computer system, such as the computer system112shown inFIG. 2A, which is usable on the LAN100. The computer system112may be any of personal computers, mini-mainframes, mainframes and the like. Although the computer system112is shown inFIG. 2Aas a network device that is part of a wired local network, the computer system112may also be connected to the LAN100by a wireless link. In this regard, the computer system112is usable in mobile environments.

Returning toFIG. 3, the computer system112includes a bus202or other communication mechanism for communicating information, and a processor204coupled with the bus202for processing information. The computer system112also includes a main memory206, such as a random access memory (RAM) or other dynamic storage device, coupled to the bus202for storing information and instructions to be executed by the processor204. The main memory206also may be used for storing temporary variables or other intermediate information during execution of instructions by the processor204. The computer system112further includes a read only memory (ROM)208or other static storage device coupled to the bus202for storing static information and instructions for the processor204. A storage device210, such as a magnetic disk or optical disk, is provided and coupled to the bus202for storing information and instructions.

As shown inFIG. 3, the ROM208includes a recovery architecture300that the processor204implements for real-time recovery of compromised information. Although the recovery architecture300is shown as stored in the ROM208, the recovery architecture300could also be stored in other memory or storage devices of the computer system112. The recovery architecture300will be described in more detail later.

The computer system112may be coupled using the bus202to a display212, such as a cathode ray tube (CRT) or a flat panel display, for displaying information to a computer user. As will be described later, the display212may display a graphical image213that is used in conjunction with the recovery architecture300to “hide” certain minimal essential information that the recovery architecture300will use in the event of a real-time recovery of compromised information. The graphical image213may be stored in a storage or memory device of the computer system112. An input device214, including alphanumeric and other keys, is coupled to the bus202for communicating information and command selections to the processor204. Another type of user input device is cursor control216, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor204and for controlling cursor movement on the display212.

The processor204can execute sequences of instructions contained in the main memory206. Such instructions may be read into main memory206from another computer-readable medium, such as the storage device210. However, the computer-readable medium is not limited to devices such as the storage device210. For example, the computer-readable medium may include a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, an EPROM, a FLASH-EPROM, any other memory chip or cartridge, a carrier wave embodied in an electrical, electromagnetic, infrared, or optical signal, or any other medium from which a computer can read. Execution of the sequences of instructions contained in the main memory206causes the processor204to perform the process steps described below. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions. Thus, the embodiments described herein are not limited to any specific combination of hardware circuitry and software.

The computer system112also includes a communication interface218coupled to the bus202. The communication interface218provides two-way data communication. For example, the communication interface218may be an integrated services digital network (ISDN) card or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, the communication interface218may be a local area network (LAN) card to provide a data communication connection to the LAN100. In an embodiment, the communication interface218is wired to the LAN100. Wireless links may also be implemented. In any such implementation, the communication interface218sends and receives electrical, electromagnetic or optical signals, which carry digital data streams representing various types of information. Communications through communication interface218may permit transmission or receipt of the intrusion detection, suppression and countermeasure agents for taking countermeasures against suspected or actual unauthorized users.

Although the recovery architecture300is shown installed on the computer system112, the recovery architecture300may be stored on other network devices101of the LAN100, including the security server114.

As noted above, unauthorized users can gain access to information on the computer system112or any of the other network devices101. Such access can compromise information on the computer system112, and the other network devices101, and may require an extensive recovery process if all the compromised information is to be recovered. For example, if the LAN100, and in particular the radar system120, is subjected to an information warfare (IW) attack, then restoration of the radar system120, and the LAN100to full operational capability may involve shutdown of the radar system120, and all, or part of other systems and components of the LAN100, followed by restart of these systems. This shutdown and restart may be very time consuming. Intruders may be able to take advantage of the down-time associated with recovery by physically attacking assets associated with the LAN100. This vulnerability may be avoided by preventing complete shutdown of the LAN100, and by instituting real-time recovery of essential systems and components of the LAN100.

To streamline the recovery process, a system in which only certain information need be recovered will be described. In this system, recovery depends on two concepts: minimal essential data, and data half-life. Minimal essential data is the smallest number or list of objects that can be used to span a system of those objects. The concept of minimal essential data is analogous to the concept of basis vectors in mathematics. A basis of a vector space V is a set of vectors (v1, v2, v3, . . . vn) that span V, and are linearly independent. Appropriate combination of the basis vectors defines all objects in the vector space V. In an analogous manner, data objects residing on the network devices101of the LAN100includes a subset of data objects that acts as the “basis vectors” for the LAN100. Given this data object subset, all other data objects in the LAN100can be defined. This data object subset is defined as the minimal essential data object set, or minimal essential information (MEI), and represents the smallest set of data objects required to reconstitute the LAN100following an information warfare attack.

FIGS. 4A and 4Billustrate the concept of minimal essential information using the example of the radar system120ofFIG. 2B. In the radar system120, certain data objects are established at system initiation. Some of these data objects may be constants, some may be changed by the radar system120itself during operation, and some may vary from their initial values. For example, upon system initiation, the data object π is established at 3.1415 . . . , and remains fixed at this value, while other data objects such as pulse width (PW), pulse repetition frequency (PRF), and scan rate, for example, may be initially fixed, but can be varied during operation of the radar system120. Other data objects are determined only during operation of the radar system120. Examples of such data objects are range and bearing. Still other data objects are computed based on data objects determined at system initialization or during system operation, or both. Examples of such “computed” data objects are target position, speed, and bearing rate. Still other data objects may be provided for use by the radar system120by systems external to the radar system120. An example of such a data object relates to weather, specifically rain (YES/NO; HEAVY/MODERATE/LIGHT), which can degrade radar performance. Using the data objects such as those shown inFIG. 4A, a processor in the LAN100can determine if a specific data object is considered minimal essential information, such that upon recovery of a system of compromised information, those data objects indicated as minimal essential information are recovered first. Such a processor may be implemented in the computer system112(seeFIG. 3), the security server114(seeFIG. 2A), or other network devices101.

FIG. 4Ashows examples of data objects associated with the radar system120ofFIG. 2B, including application of the concept of minimal essential information. InFIG. 4A, nine such data objects associated with operation of the radar system120are displayed. However, the radar system120would comprise many additional data objects. The data objects include range270, bearing272, target position274, speed276, direction of motion278, acceleration280, π282, rain284, and classification286. Also shown inFIG. 4Aare parameters that may be associated with each of the data objects. In particular, a data object field288names the data object; a creation field289indicates if the data object is original data directly generated (measured) by the radar system120, or is computed by the radar system or some system external to the radar system120; a time of creation data field290indicates when the data object was created (system initiation, operation); an origin data field291indicates the source of the data object (self, external); a variable data field292indicates if the data object is constant or variable; a refresh rate data field293specifies a desired frequency for updating the data object; a value data field294assigns an initial value (which may be variable or constant) to the data objects; a threshold data field295assigns a threshold to the value data field294for selected data objects; and a minimal essential information data field296indicates if a data object is considered minimal essential information.

FIG. 4Bshows selected data objects fromFIG. 4Aarranged in a hierarchical fashion. InFIG. 4B, the data objects are arranged according to how the data objects are created, i.e., measured directly in the radar system120(or other system) or the result of one or more computations executed in the radar system120(or other system).FIG. 4Bshows four hierarchical levels0-3. At level0, the data objects target range270and target bearing272are measured by the radar system120, and thus are identified as self-generated (entry291) data objects that are created during operation (entry289). Also shown at level0are measured, and variable data objects285associated with radar operation, including PW, PRF, scan rate, strength of return, and a time strobe, all of which are determined (created) at least at system initiation (entry290). At level1, the processor126makes a number of computations to generate additional data objects, including bearing rate273, aspect275, speed276, and direction of motion278, using the data objects from level0. At level2, the processor126makes additional computations to generate the data objects of classification286and acceleration280. At level2, the processor126is also shown receiving the data object rain284from a source external to the radar system120. At level3, the processor126uses selected data objects from levels0-2to generate data objects maximum unambiguous range277(which is a function of PRF, but which may be affected by rain); and range resolution279(which is a function of PW, but which may be affected by rain).

Returning toFIG. 4A, some data objects can be seen to have an exponentially decreasing value, or data half life. Data half-life refers to the fact that in the LAN100, each data object has a temporal value that can be likened to an atomic half-life. In the environment represented by the LAN100, data half-life means that over time, a data object looses its value. Specific data objects will have different half lives. At some point in this data value “decay,” the data becomes invalid or obsolete. If a data object that has become invalid is used in a computation, the result may be mathematically accurate but operationally meaningless. For example, a position of a target T1at system time t1may not be useful for computations at system time t100. A message stating that an attack has begun may be obsolete shortly after the message is promulgated. Some data objects, such as constants, for example, may always be valid and have value. For example, π (3.1415 . . . ) is valid at all times. Thus, each data object within the LAN100has a time window in which the data object is valid and has value. Of course, decay schemes other than exponential, including straight line decay, may be more appropriate for characterizing the decreasing value of a data object.

This concept of data decay leads to the following:Individual data objects can be tagged to indicate real time of last computation. An example is “Target Position History,” which carries a time tag that relates the target position to time of observation.Data objects can be changed at a periodicity that depends on meeting certain conditions. As an example, “Target Classification” can change when certain conditions are met, such as changes in target characteristics. Software that analyzes whether a target is friend or foe executes at a periodic rate, but the value of a friend or foe flag could be set or reset during any of the periodic computations.Data objects can be integrated over time. Such integration usually involves filtering (e.g., Kalman filtering) of the data object. As an example, a data object, “Current Target Position,” uses a value of“Previous Target Position,” filtered with a value of“Latest Target Position” provided to the LAN100from a primary sensor, such as that in the radar system120.

Using the above-described concepts, recovery of compromised data involves two distinct phases: Analysis, in which appropriate data objects and their associated parameters are selected; and Execution, in which a network device101on the LAN100sequences and automates data recovery. The Execution phase can be further subdivided into a pre-IW attack stage, a recovery stage, and a post-IW attack reconstitution stage. These phases and stages will be described below in detail.

FIG. 5Ais a block diagram of the program architecture300, operable on a network device101of the LAN100, such as the computer system112or the security server114, for executing the Analysis and Execution phases. The architecture300includes a service manager310, an agent manager320, an applications manager330, a data analyzer340, a graphical user interface (GUI) module350, a user input manager360, a detection manager365, and a recovery manager370. The recovery manager370will be described in detail with reference toFIGS. 5B-5D. The agent massager320determines which data objects exist on the LAN100, and characterizes such data objects as to a time when the data objects are created. That is, the data objects may be initially declared (e.g., at compile time, and whether the data objects are declared at LAN100or network device start-up or during operation of the LAN100or network device). Alternatively, the data objects may be created as the result of multiple computations. The agent manager320examines each data object and assigns the data object a value depending on its mode of creation. In executing these functions, the agent manager controls a number of agents that operate within a node, or traverse from node to node in the LAN100. Functionally, an agent is computer software, transportable over a computer network from one computer to another, to implement a desired function on the destination computer. An agent can also be defined as a transferable self-contained set of executable code instructions. From a code perspective, the preferred agents are collections of Java classes combined with a collection of persistent objects. The agents can be also written in many languages such as C++, C and assembler and other languages known to those of skill in the art.

The service manager310determines if a data object is a constant, and then tags such a data object as a constant. For all other data objects, the service manager310determines a refresh rate, and associates this refresh rate with the data object.

The applications manager330determines the application and process hierarchy-for use of the data objects. That is, system application software may have a hierarchy that is based on system mode. The hierarchy then defines how, and in what order, specific processes execute. The execution of specific processes may require specific data objects to be available to support computation of other data objects. For example, in the radar system120, target speed is obtained by differentiating distance traveled by a target over time. To obtain distance traveled by the target, the target's range and bearing at least two points in time must be known. The distance traveled by the target is then the straight line subtending the arc between the two bearings, and the length of the straight line is a function of target range.

The data analyzer340identifies the minimal essential information for each system in the LAN100, and for each mode of operation of the system in the LAN100. For example, the radar system120may operate in a search mode or a track mode, and in these two modes, the minimal essential information may differ. To identify minimal essential information, the data analyzer340first applies a series of qualifiers to the list of available data objects. For example, in the radar system120, one such qualifier may be the target classification as friend, foe, or unknown (unk). When the radar system120is operating to track hostile targets, only targets classified as foe may be important to reconstituting the system in the event of information compromise. Thus, a classification qualifier of “foe” may be applied to the universe of target objects in the radar system120to produce minimal essential information. A second qualifier may be time of last detection of the “foe” targets. Thus, a detection of a “foe” target may be considered minimal essential information if such a detection is the minimal sufficient to derive target motion data objects, for example.

The GUI module350controls a graphical user interface that is used to display information to a human operator. The user input manager360receives user inputs and directs those inputs to the data analyzer340for execution. Through the user input manager, a human operator can override decisions of the data analyzer340in characterizing a specific data object as minimal essential information. For example, when tracking hostile targets using the radar system120, the data analyzer340may identify target classification as minimal essential information. However, a human operator may apply an additional qualifier of minimum target range as additional minimal essential information.

The detection manager365contains the software routines, data storage capacity, and processing means to detect an IW attack anywhere on the LAN100. Copending applications, entitled “Steady State Computer Intrusion And Misuse Detection” and “System and Method for Real-Time Network-Based Recovery Following an Information Warfare Attack,” assigned to the instant assignee, and filed on even date herewith, and incorporated herein by reference, describe mechanisms to detect computer misuse and intrusion. Detection may be based on a number of potential activities that are monitored by the detection manager365. For example, insider misuse can be detected when an authorized user performs an unauthorized, or perhaps, infrequent operation that may raise the suspicion that the authorized user's computer is being misused. An unauthorized user could obtain the password of an authorized user, logon to the LAN100from the authorized computer user's computer, and attempt to perform operations not typically associated with the authorized user. In another example, user profile data may stored in an audit database and may be used to detect an intrusion. The user may have access to a particular database but has not accessed the database for over a year. A sudden access of the database may be inconsistent with the user profile, and may generate an alert that an intrusion or insider misuse is occurring. In yet another example, the software agents controlled by the agent manager320may not make reports back from a particular network device101, indicating an IW attack is occurring at the network device101. Still examples are an attempted login by a computer that does not have access to the LAN100, attempted logons that tried to login three times but failed, excess system calls, too many root logins, and system memory changes.

An example of the execution of the architecture300as applied to an airborne radar system120shown inFIG. 2Bfollows. In this example the radar receiver124receives a return signal from an aircraft, and the radar system120enters an automatic tracking mode. The first return signal establishes the target's initial position (range and bearing). Subsequent returns, which may occur with a frequency based on the radar's “scan rate,” establish second and subsequent target positions. Using the target positions, the processor126in the radar system120computes target speed, direction of motion, and acceleration (if applicable). The radar system120, or a separate processor or other component (not shown) may also establish an initial classification, including whether the target is a threat/non-threat (i.e., friend or foe), and type of aircraft, for example. The radar system120may display certain of these target parameters to human operators, and may provide target information to other devices101in the LAN100. Assuming the target is detected at times t1, t2, t3, t4. . . tn, then data related to the target may be based on any or all of these target detections. Certain data, such as range and bearing, for example, are “original data” while other data, such as target speed and direction of motion, are “computed data.” In terms of relevancy, “original data” associated with time t1is not likely to be as relevant as “original data” from tn(the most recent detection). With respect to computed data, particularly data such as direction of motion, for example, data from times tn-2, tn-1, and tnmay be equally relevant in computing a straight line direction of motion, while data from times t1-t4may be less relevant.

The determination of which data events are relevant, and consequently the determination of data half-life, may be automated through use of the architecture300. For example, the data analyzer340may apply an exponentially decreasing function to values of data points more than three detection earlier than the most recent detection, when such data are used to compute direction of motion. Similarly, the data analyzer340may apply an exponentially decreasing function to all original data. Then, for any specified use, the data analyzer340may determine a half life value (e.g., the threshold295, seeFIG. 4A) below which a specific data object is no longer worth recovering. The determination of the half life threshold295may be based on time, or may be based on a number of observations.

FIG. 5Bis a block diagram of the recovery manager370. The recovery manager370receives the minimal essential information (MEI) and other recovery information. The recovery manager370includes a control module372that controls processing by components of the recovery manager370, an encryptor/decryptor376that encrypts and decrypts the minimal essential information, a compressor/decompressor that compresses and decompresses the encrypted/decrypted minimal essential information; a timing module374that tracks certain time intervals for use in recovering the LAN100in the event of an IW attack; a steganographic system380that “hides” the minimal essential information, and a recovery system393that implements recovery routines in the LAN100. The steganographic system380and the recovery system393will be described in detail with reference toFIGS. 5C and 5D, respectively,

FIG. 5Cis a block diagram of the steganographic system380. The steganographic system380uses the well-know art of steganography to “hide” the minimal essential information on components of the LAN100so that the minimal essential information is less susceptible to a cyber attack.

Data hiding is a class of processes used to embed recoverable data in digitally represented information, such as a host image, with minimal degradation to the host information. In the context of the LAN100, the goal of data hiding is to insulate the minimal essential information from an IW attack on other parts of the LAN100.

After receiving the minimal essential information, the encoded image may undergo intentional and inadvertent modification due, for example, to channel noise, filtering, resampling, rotation, cropping, lossy compression, or digital-to-analog (or analog-to-digital) conversion. In order to be effective, the data hiding technique embeds the minimal essential information in a manner that allows determination of its presence or absence even after such modifications.

In an embodiment, the steganographic system380embeds one bit, or a pattern of bits, indicating the presence or absence of the minimal essential information, in a host image in a manner that allows detection of the bit, or pattern of bits, by exploiting the behavior of sums of a large number of random variables. Specifically, the data-embedding technique requires altering characteristic parameter values at a set of pseudo-randomly chosen locations in the host image in a manner that markedly changes the expectation value of some linear combination of mathematical functions of the values at that set of locations. The embedded minimal essential information is recoverable from an test image by calculating an experimental value of a linear combination of a large number of instances of the functions and comparing the experimental value with the expectation value of the sum for the unaltered host image. Many other data hiding techniques are available for embedding the minimal essential information in another digital data file. Such techniques are well known in the art, examples of which are taught in U.S. Pat. Nos. 6,314,192, 6,301,360, and 6,252,963, the disclosures of which are hereby incorporated by reference.

The embedding is done by first randomly selecting a large number of locations in the host image, for example by associating locations in the image with members of a series of pseudo-random numbers. In the general case, the locations are partitioned into first and second groups. The host image is then altered by increasing the values of the characteristic parameter at locations belonging to the first group and decreasing the values of the same parameter at locations belonging to the second group. For digitally encoded images, the locations correspond to groupings of adjacent pixels.

Decoding entails determining whether or not an test image includes the embedded pattern. To decode, the selection and partition of locations generated during the embedding process is recreated, for example, by supplying a key specific to the pattern to a pseudo-random number generator and then applying the partition procedure. The decoder then calculates an experimental value of a test statistic, formulated to reflect the alterations to the host image associated with the statistic, of the parameter values assessed at the selected locations in the image. Generally, the test statistic is equivalent to a linear combination of many instances of respective functions of the parameter values of locations belonging to the first and second groups. For example, since the parameter values of the first group locations are all increased and those of the second group all decreased, an appropriate function would be the difference between the sums of the parameter values over the first and second group locations. This calculation does not require the decoder to have the host image.

If the probability density functions of the parameter at all locations have finite expected value and variance and are identical and independent of the values assumed at other locations, then a test statistic equal to the sum of a large number of instances of a linear combination of the parameters assumes a Gaussian form. This property facilitates determining quantitatively whether the observed value of the test statistic indicates operation of the probability density function associated with the unaltered host image or of the shifted density associated with the embedded pattern. A Gaussian description may be appropriate even for statistics that do not conform to the restrictions just listed. Furthermore, even a non-Gaussian statistic can adequately differentiate between an unshifted and a shifted probability density function. The likelihood of an observed experimental value's belonging to a density of known expected value can be bounded using the Chebyshev inequality, for example.

The reliance of the decoding on the statistical properties of combinations of many numbers renders the embedded minimal essential information resistant to defeat by degradation of the image carrying the pattern. The express knowledge of the location selection and partition as well as of the specific alteration to the parameter values that is required to reverse the encoding makes the embedded bit resistant to intentional removal from the altered host image. Applying the changes to pixel groupings protects the embedded bit from obliteration by lossy compression, tone correction, filtering, cropping, and affine transformation.

InFIG. 5C, the steganographic system380is shown to include a system bus381, over which all system components communicate, a mass storage device (such as a hard disk or optical storage unit)382and a main system memory383.

A processor384controls operation of the steganographic system380and its components. To facilitate rapid execution of the image-processing operations, the steganograplic system380also contains an image-processing board385.

In an embodiment, the steganographic system380is automated using the processor384to embed the minimal essential information in a host image on a network device101of the LAN100. Alternately, a human operator can interact with the steganographic system380using a keyboard386and a position-sensing device (e.g., a mouse)387. The output of either device can be used to designate information or select particular areas of a screen display388to direct functions to be performed by the steganographic system380.

The main memory383contains a group of modules that control the operation of processor384and its interaction with the other hardware components. An operating system389directs the execution of low-level, basic system functions such as memory allocation, file management and operation of mass storage unit382. At a higher level, an analysis module394, implemented as a series of stored instructions, directs execution of the primary functions of the steganographic system380. Instructions defining a user interface395allow straightforward interaction over the screen display388. The user interface395generates words or graphical images on display388to prompt action by the user, and accepts user commands from the keyboard386and/or position-sensing device387. A random number generator396creates the ordered series of pseudo-random numbers used in encoding or decoding.

The main memory383also includes one or more input image buffers390that contain image(s), such as a host image, used as input for processing by the processor384and output image buffers391that contain an output image generated by that processing. The contents of each input or output image buffer390and391define a raster, i.e., a regular two-dimensional pattern of discrete pixel positions that collectively represent an image and may be used to drive (e.g., by means of image-processing board385) screen display388to display that image. The values of pixel parameters, such as luminance, contained at each memory location in the image buffers390or391directly governs the appearance of a corresponding pixel oil the display388.

One or more databases392contain encoding and/or decoding information, e.g., the output of the random number generator396, the key used by the random number generator396to generate the pseudo-random number series, the role governing assignment of pixels to groups, the description of groups, the test statistic formulation, and expected value or descriptions of geometric transformation. One or more of the databases392may be associated with each one of the image buffers390or391and contain information specific to the image contained in the associated buffer; or, one database392may contain information generic to all images encoded or decoded by the apparatus. The databases392may be stored in the mass storage device382in file(s) linked to file(s) containing the associated image(s).

FIG. 5Dis a block diagram of the recovery system393. The recovery system393includes a damage assessment module401, recovery routines402, and a messaging manager405. The recovery routines402include primary reconstitution routines403and secondary reconstitution routines404. The recovery system393is preferably implemented as software operating on one or more network devices101of the LAN100.

The damage assessment module401contains software routines to determine the extent of data corruption and other damage that may have occurred to the network devices101. The messaging manager405provides the necessary messaging from the recovery system393to components of the LAN100, such as the network devices101. The primary reconstitution routines403provide the instructions required to perform the limited, “hot-start,” or real-time recovery of the LAN100following an IW attack. The secondary reconstitution routines are the instructions needed to restore the LAN100to full operation following an IW attack.

One of ordinary skill in the art will understand that although the modules of the architecture300have been described separately, this is for clarity of presentation only. As long as the architecture300performs all necessary functions, it is immaterial how they are distributed within the LAN100.

FIG. 6is a flowchart showing the major process steps in preparing for an IW attack, and for subsequent recovery. Following startup399, the routines begin with Analysis routine400, in which data objects are identified as necessary or desired for real-time recovery of compromised information in a computer network. Once the data objects are identified, the computer network can begin operations to prepare for and recover from an IW attack. The Execution routine499begins with pre-IW attack routine500, in which the data objects identified in Analysis routine400are used to gather information needed for recovery from an IW attack. In block560, the security sever114determines in the LAN100is subject to an1W attack. If no, the Execution routine499returns to pre-IW attack routine500. If yes, the Execution routine499moves to recovery routine600. In recovery routine600, minimal essential information created in routines400and500are used for a streamlined recovery of the LAN100and its network devices101. Finally, in reconstitution routine700, secondary recovery of the LAN100is completed. After secondary recovery is completed, the LAN100is in a normal operating mode and the Execution routine499returns to routine500.

FIG. 7Ais a flowchart illustrating the Analysis routine400, used with the LAN100, for selecting appropriate data objects and their parameters to allow automatic recovery of compromised data. The Analysis routine400may be performed “off-line,” and determines the minimal essential information, how the minimal essential information are accessed, and how the remaining data are derived in the LAN100. The Analysis routine400also determines the computational characteristics of the minimal essential information. The Analysis routine400may be automated using a network device101, such as the computer system112, that is suitably programmed to provided the requisite analysis.

The Analysis routine400begins with the service manager310determining how system data are created (block410). Next, the service manager310determines if the data are constant (block420). If the data are constant, the Analysis routine400moves to block440. If the data are not constant, the service manager310determines a refresh cycle for the data (block430). The Analysis routine400then moves to block440. In block440, the data analyzer340determines what relationships exist between the data object and other data objects, and sets the computational ordering.

The data analyzer340then determines if the data object should be identified as minimal essential information. In block460, the data analyzer340determines the optimal timing for updating the minimal essential information. In block470, the service manager310determines if all data objects have been analyzed. If not all data objects have been analyzed, the Analysis routine400returns to block410, and the next data object is analyzed. Otherwise the Analysis routine400ends, block471.

FIG. 7Bis a flowchart illustrating routines for setting the computational ordering and determining the minimal essential information. In block441, the data analyzer340receives data object DOifollowing completion of process blocks420or430(seeFIG. 7A). In block442, the data analyzer340reviews the data source of DOi. Next, in blocks443449, the data analyzer340determines the origin and creation of DOiand either holds the data object in a buffer for eventual designation as minimal essential information, or rejects the data object. In particular, in block443, the data analyzer340determines if DOiis from an external source. If so, DOiis rejected (block444). If DOiis not from an external source, the data analyzer340determines if DOiwas created through a computation, block445. If so, DOiis rejected (block446). In block447, the data analyzer determines if DOiwas created by the radar system120itself, and the creation was the result of initiation or operation of the radar system120itself. If so, DOiis held in a buffer, block448. If DOiis not self-created, then in block449, the data analyzer340determines if DOiis from a manual override. If so, DOiis held in a buffer, block450. Otherwise, an error is declared, block451. Next, in block452, the data analyzer340determines the computational hierarchy for DOi. Specifically, the data analyzer determines which computations rely on DOi. Finally, in block453, the data analyzer340designates DOias minimal essential information. The routine440then moves to block460.

FIGS. 8A-8Care flowcharts illustrating a process, executable on a network device101the LAN100ofFIG. 1, for automatic, real-time recovery of compromised information.FIG. 8Ashows the routine500for pre-IW attack Execution phase operations. The routine500starts in block501. In block510, the recovery manager370executes processes at pre-determined intervals to maintain optimal data gathering, computations and messaging. In block520, the recovery manager370selects recovery parameters and updates components of the recovery manager370. In block530, the encryptor/decryptor376encrypts the minimal essential information designated by the data analyzer340. The compressor/decompressor378then compresses the minimal essential information. The encrypted, compressed minimal essential information is the processed through the steganography system380, and is hidden in host files (e.g., host images such as graphical images displayed on a computer screen) on the LAN100(block540). Next, in block550, the timing module374records time marks for specific events, including the time of last update of time-dependent data objects (e.g., target bearing); time of last hot recovery from an IW attack; and time of last storage of minimal essential information. Then, in block560, the recovery manager370determines if a system on the LAN100is undergoing an IW attack. If the LAN100and its systems are free from an IW attack, the routine500moves to block570and the recovery manager370resets a recovery flag indicating that the routine500should continue to ensure that the latest values of the minimal essential information are available and hidden on the LAN100. If the LAN100and its systems are experiencing an IW attack, the routine500ends and processing moves to recovery routine600, shown inFIG. 8B.

FIG. 8Bis a flowchart illustrating the recovery routine600. The recovery routine600begins after a determination that the LAN100, or network device101, is being subjected to an IW attack (block560ofFIG. 8A). In block610, the recovery manager370sets necessary system parameters to initiate a “hot recovery” mode, which will eventually return the LAN100to normal operation. Next, in block620, the recovery manager370accesses real-time damage assessment information, ascertains the extent of damage to the LAN100, and selects appropriate recovery routines402(i.e., the primary reconstitution programs403). In block630, the recovery manager370, using the steganographic system380and other systems, retrieves, decrypts, and decompresses the stored minimal essential information. In block640, the recovery manager370restores the minimal essential information to the portions of the LAN100that were damaged by the IW attack, and executes the primary reconstitution programs403. Finally, in block650, the recovery manager370notifies LAN100users that the IW attack has occurred, and that hot recovery operations are complete. The recovery manager370then moves to post-IW attack operations.

FIG. 8Cis a flowchart illustrating the post-IW attack reconstitution routine700. InFIG. 8C, the recovery manager370establishes network interconnections in the LAN100as needed, and informs the connected systems of the recovery, block710. In block720, the recovery manager370invokes secondary reconstitution routines404. In block730, the recovery manager370clears all system recovery flags so that all recovery operations are complete, and normal operation of the LAN100can recommence. The process then returns to analysis routine500.

Following is an example of the use of minimal essential information to recover compromised information. The example is based on data objects associated with tracking the target using the radar system120ofFIG. 2B, and considering the data objects shown inFIG. 4A. A target position data object274is created during operation of the radar system120, and hence the agent manager320codes (entry290) the target position data object as “during operation.” Because the target position data object274changes with time, the service manager310flags the data type as not constant, and assigns a refresh rate (entry293) equal to the radar scan rate. Given two or more values of target position, the radar system120, or a separate processor, can determine speed and direction of motion (i.e., velocity). Thus, the data analyzer340indicates the target's speed276and direction278as data objects related to the target position data object274(entry289). Once velocity is known, the radar system120can compute acceleration when velocity changes, and an acceleration data object280is added as a related data object (entry289). Given the data objects270,272,276, etc., the data analyzer340determines that the minimal essential information for tracking the aircraft to be the last two target range and bearing values (entry296).