Joseph Giordano

Reconstructing the Database after Electronic Attacks

In spite of all existing security mechanisms, it is quite difficult to protect databases from electronic attacks. This research provides techniques to make an assessment of the damaged data and then to recover the affected data to consistent states after an attack is detected. Damage assessment is done using data dependency approach in order to obtain precise information on the damaged part of the database. Two algorithms are presented in this paper. The first algorithm performs the damage assessment and recovery simultaneously; whereas the second algorithm separates these two processes for improved efficiency. Both algorithms allow blind- writes on data items allowing damaged items to be recovered automatically.

A process control approach to cyber attack detection

A computer and network system must be protected to assure security goals such as availability, confidentiality , and integrity, by using a variety of techniques for prevention, detection, isolation, assessment, reaction, and vulnerability testing. Attack prevention can be enforced through firewalls and guards, boundary control with security policies, authentication, and encryption. Attack detection identifies cyber attacks passing through the barriers of prevention on a computer and network system. Attack isolation reveals the source and path (course of actions or core events) of a cyber attack leading to observed attack symptoms as well as affected entities , including users, files, programs, hosts, and/or domains. Attack assessment determines the degree and nature of damage to affected entities with respect to the overall security risk. Attack reaction takes control actions to get an attacker out of a computer and network system, maintains the system operation even in a degraded condition, and eventually recovers the system back to a normal state. Vulnerability testing looks for points (a weak password , for example) of a computer and network system that make the system vulnerable to cyber attacks. Information assurance activities are similar to process control activities usually carried out to assure the safe operation of many engineering systems , such as energy generation systems in nuclear power plants. Process control activities include: • System planning to design, specify, and implement laws and rules governing safe system operation ; and • System control to assure the safe operation of the system through diagnostic control and routine maintenance. Diagnostic control monitors online system operation data for the presence of fault symptoms, traces the source and path of faults, assesses the impact of faults, and takes control actions to recover the system back to a normal state. Routine maintenance collects and uses the historic data of system component reliability to set up an inspection and maintenance schedule and performs scheduled inspection and maintenance. When placing information assurance in the context of process control, attack prevention is analogous to system planning. Attack detection, A cyber attack is an attack on a computer and network system, consisting of computer actions such as remote or local connection, computer file access, or program execution with the intent to compromise the secure operation of the computer and network system. Because we increasingly rely on information infrastructures to support critical operations in defense, banking , telecommunication, transportation, electrical power, and many other systems, cyber …

BASIS: A Biological Approach to System Information Security

Advanced information security systems (ISS) play an ever-increasing role in the information assurance in global computer networks. Dependability of ISS is being achieved by the enormous amount of data processing that adversely affects the overall network performance. Modern ISS architecture is viewed as a multi-agent system comprising a number of semi-autonomous software agents designated to prevent particular kinds of threats and suppress specific types of attacks without burdening the network. The high efficiency of such a system is achieved by establishing the principles of successful individual and cooperative operation of particular agents. Such principles, evolved during evolution, are known to be implemented in biological immune systems. The aim of this paper is the exploration of the basic principles that govern an immune system and the potential implementation of these principles in a multi-agent ISS of a heterogeneous computer network.

Information fusion techniques for network intrusion detection

Many intrusion detection techniques produce values of indications and warning (IW) that account for only isolated effects of computer network intrusions. To address interactive effects of network intrusions involving coordinated actions, it is necessary to correlate and fuse IW values for providing an accurate assessment of network intrusions. Information fusion techniques are presented.

Component integrity check and recovery against malicious codes

With the rise in usage of software components in distributed computing applications, the importance of safeguarding these components has assumed great significance. In trying to ensure the survivability of these components, we enable a mission-critical application to detect malicious codes in a component downloaded from a remote location and recover the original functionality of the compromised component. In our work, we use digital signatures to ensure the integrity of software components in a large distributed system. By detecting unauthorized add-ons to the original components we can ensure that only legitimate software components are allowed to execute in a protected software environment. We also explore techniques to recover the original functionality of the component under attack by removing the affected portion from the component. In this paper we introduce the system architecture and the support mechanisms for our proposed approaches

Trusted Component Sharing by Runtime Test and Immunization for Survivable Distributed Systems

As information systems became ever more complex and the interdependence of these systems increase, the survivability picture became more and more complicated. The need for survivability is most pressing for mission-critical systems, especially when they are integrated with other COTS products or services. When components are exported from a remote system to a local system under different administration and deployed in different environments, we cannot guarantee the proper execution of those remote components in the currently working environment. Therefore, in the runtime, we should consider the component failures (in particular, remote components) that may either occur genuinely due to poor implementation or the failures that occurred during the integration with other components in the system. In this paper, we introduce a generic architecture and mechanisms for dynamic component-failure detection and immunization for survivable distributed systems. We have also developed a prototype system based on our approaches as a proof of our ideas.

An overview of post information warfare data recovery

This research presents a synopsis of a method to make an assessment of the damage made to the database in an information warfare situation. The protocol requires a modified log to store necessary information to re-compute the affected operations of benign transactions. After an attack is detected, the algorithm presented in this paper scans the log to assess the damage and then recovers the damaged data to a consistent state.

A Framework of Multiple-Aspect Component-Testing for Trusted Collaboration in Mission-Critical Systems

Although we need software-component sharing in a large distributed system, we cannot simply trust those components provided by participating organizations, especially when malicious groups or competitors are involved in the collaboration. When a wide range of malicious activity needs to be tested, a large overhead is incurred in scanning for malicious code and checking internal failures. Large projects also have multi-functional teams working and any lack of communication or overlooks in design can lead to unchecked security holes when the system is integrated. Moreover, it is not always easy to test the whole system for security and accuracy in preventing attacks because one can never develop a test plan for that which one is unaware of, such as a specialized attack by a hacker that compromises a system. Therefore, in this paper we develop a dynamic approach for testing software components in using multiple aspects of testing with high accuracy. We also present new techniques that provide for an automated system architecture that provides for a scalable and flexible distributed testing mechanism capable of handling newer threats at very short notice. We have considered the use of Microsofts .Net and C# as the platform to describe and prototype the testing mechanisms

Intrusion Detection System Modeling

Database management system (DBMS) controls and manages the data to eliminate data redundancy and to ensure data integrity, consistency and availability, among other features. Even though DBMS vendors continue to offer greater automation and simplicity in managing databases, the need for intrusion database modeling and management practices have not been considered. Our research focuses on not only anomaly detection but also intrusion database management through planning and best practice adoption to improve operational efficiency, lower costs, privacy and security

Fine-grained, scalable, and secure key management scheme for trusted military message systems

As the military message system grows, managing large numbers of users and messages with their different security levels becomes very complex and time-consuming. This problem is magnified when it comes to providing fine-grained security services, such as assigning multiple classification levels to different parts of the same message. The number of keys to he managed also increases enormously, especially when a set of session keys is required to protect each message. Obviously, those requirements introduce the problem of scalable key management into a trusted military message system. Conventional key management schemes cannot solve this problem. In this paper we introduce a fine-grained, scalable, and secure key management system for a trusted military message system. We also implemented a prototype message system based on our ideas to show their feasibility.