Christopher C. Jones

Adaptive cyberdefense for survival and intrusion tolerance

While providing some resistance against cyberattacks, current approaches to securing networked and distributed information systems are mainly concerned with static prevention measures. For example, signature-based systems can only detect known attacks and tend to provide brittle, all-or-nothing protection. New work in survivability and intrusion tolerance focuses on augmenting existing information systems with adaptive defenses. A middleware-based survivability toolkit lets applications use network-and host-based mechanisms in their own defense.

Building auto-adaptive distributed applications: the QuO-APOD experience

Exploiting autonomic adaptation in defending a distributed application is a relatively new research area. We describe how the QuO adaptive middleware was used to implement auto-adaptive defenses ranging from simple rapid response sensor-actuator tactics to more sophisticated containment and outrun strategies. In addition, we report on two experiments where live red team attacks were used to evaluate our auto-adaptive defense technology.

Adaptive use of network-centric mechanisms in cyber-defense

Attacks against distributed systems frequently start at the network layer by gathering network related information (such as open TCP ports) and continue on by exhausting resources, or abusing protocols. Defending against network-based attacks is a major focus area in the APOD (Application That Participate in Their Own Defense) project, which set out to develop technologies that increase an applications resilience against cyber attacks. This paper gives an overview of APODs current set of network-level defenses. Specific network-based defense mechanisms are described first, followed by a discussion on how to use them in local defensive behavior. Defense strategies, which specify coordinated defensive behavior across a distributed system, are discussed next, followed by results from initial experimental evaluation.