Future directions for behavioral information security research

Upon discovery, security administrators must determine how computer system intrusions were accomplished to prevent their reoccurrence. This paper describes an automated diagnosis system designed to focus investigation on the evidence most likely to reveal a hacker’s method. The system takes as input victim configuration and vulnerability information and a description of the unauthorized access gained by the attacker. With this information and templates describing hacker exploits and computer actions the system generates possible attack sequences. Because it is impossible to know everything the attacker might be aware of or have done, attack hypotheses can include assumptions where there is no apparent action to accomplish part of an attack. The hypothetical attacks are next simulated on a model of the victim network. Successful simulation indicates a feasible means of accomplishing the unauthorized access. The simulation generates representative log entries that a pattern matching subsystem compares to system records. Close matches are indicators that the associated hypothesis was the means of attack.

/pdf/automated-diagnosis-for-computer-forensics-374wbpv98h.pdf

Automated diagnosis for computer forensics

: The problem addressed by this work was to reduce the time taken to train system administrators in detecting computer security problems in system audit logs. The approach taken was to develop a simulator which generates realistic audit logs that illustrate both non-malicious and malicious behavior. These logs can be used to train system administrators. The simulator was written in Prolog and used means-ends analysis to simulate seventeen combinations of general system functions which includes the following: logins, editing, file deletions, file copying, changing file access rights, obtaining superuser privileges, sending mail and logouts. The simulation manipulates virtual system files analogously to what real users do. This creates realistic audit file logs that include a mixture of normal and malicious activity. More impressive is that the entire source program requires only 19.1 kbytes of space, making it small enough to be compatible with a personal computer. (KAR) P. 2

Christopher C. Roberts

Papers

Plan-Based Simulation of Malicious Intruders on a Computer System.