Sunday, February 20, 2005
On the discussion of data
regularity à
On the Stephenson Cyber Attack
Taxonomy à
Mike,
Very interesting response from your Bell Labs colleague. I would like to address his two comments if I may because they are, as I'm sure he noted, at the core of the work I am doing.
---------
To the point mentioned "If they (attacks) can exist at all, they will
behave in a predictable manner on a very large network such as the
Internet." He said "Nope...otherwise you would never need to do
performance testing of telecom networks...IT systems would behave predictably
in the face of errors/bugs/unexpected demands (all of which are a category of
attacks)." ----------
I think part of the problem here is that he and I may attach different abstraction levels to "predictable" The position we are hypothesizing is that given a particular set of circumstances, an attack will behave predictably. That set of circumstances may include acknowledgement of errors/bugs/etc. We view attacks, threats and vulnerabilities at the level of a class rather than the atomic level of the individual threats or vulnerabilities, or the molecular level of attacks.
We do not say that an attack, as defined or observed at the point of attack, will behave predictably over the course of the attack regardless of other factors in its path. If that were our hypothesis, I would agree with your colleague completely. The challenge here is to abstract far enough away from the "unpredictable" behavior to arrive at "predictable" behavior against which we can defend without generalizing unacceptably. That is at the core of our research and the problem we seek to solve.
Paul has an approach called Bypass Theory that, along with Categorical Abstraction, is perhaps giving us some ways to simplify this process and, perhaps, get to a level where we can, in fact, predict attack behavior, not by looking at the attack itself, but by looking at the impact on its environment. That change of perspective (from the attack to its impact upon its environment) is critical to this theory. We are using a stratified ontology to help understand classes of attack behavior in a rigorous manner and we expect that to help us as well.
Also, however, we are attempting to understand the environment in which the attack will exist and make some useful generalizations about it. Without that view of the environment (the exophysics) as a starting point we cannot understand anomalistic behavior caused by an attack (the endophysics). The conjecture is that it is the interaction of the exophysics and the endophysics that produces, potentially, observable anomalistic behavior. On the gross level we see that clearly at the victim when an attack is realized and we see it across the Internet in large-scale worm attacks (Nicol, "BGP Instability Forensics").
-----------
On the point of "We conjecture
that it is possible, theoretically, at least, to have total protection against a
threat of any kind, known or unknown, as well as against vulnerabilities of any
kind, also known or unknown." He said "Theoretically it is impossible
to protect against all threats for the same reason it is formally impossible to
exhaustively test software against all bugs...it's provably not possible."
------------
The notion of an artificial immune system is that it knows the difference between self and not-self and defends accordingly just as a biological immune system would. Within that context our hypothesis is that such a system can be made to recognize an attack against it, regardless of the nature of the attack, and respond. There really is not a relationship between testing software for bugs and defending against attacks if we look at defense mechanisms in that manner.
The paradigm that an attack behaves like a software bug is, on the surface (i.e., viewing the results, for example - both may result in failure modes) obvious and results in an inability to protect. I agree with that. However, we are not approaching the problem from that perspective. It is precisely *because* that won't work that we are taking a completely different view.
If one removes trivial applications of artificial immune systems (such as agents on protected devices reporting to a central analysis engine - really little more than an IDS on steroids) from the picture and evolves an artificial immune system that behaves the way a biological system behaves, we conjecture that we can immunize a system down to the level of the individual computer. However, there are significant technical and theoretical barriers to overcome.
For example, how does one deal with auto-immune problems where the system attacks itself? What about a digital version of AIDS? How does the artificial immune system distinguish between self and not-self? As self evolves (i.e., new applications, O/S upgrades, etc.) how does the system maintain it's knowledge of that distinction? How does one instrument the environment to make useful observations about activity and interactions within it? Etc., etc.
By viewing attacks at an appropriate level of abstraction and considering attack behavior instead of the attacks themselves, we hope to reach a level of analysis that is sound for classes of attacks rather than specific attacks. This approach is necessary exactly for the reason expressed: at the granularity of an individual attack, it is provably not possible to know every attack, threat and vulnerability.
We do not claim that this is a trivial problem for which we propose a trivial solution. We recognize the difficulties involved, but we believe that a solution is possible.
I invite your colleague to continue to share his comments on this work... his insight and experience could be quite valuable. I don't know if you're familiar with the Groove collaborative workspace application... I have it set up with a new workspace for this project and I invite you and your colleague (and anyone else in the cc list who would like to contribute to the effort) to join us in discussion. It is a peer to peer system, fully public key encrypted, that uses a centralized store and forward mediator to move data between collaborators. All the data is encrypted wherever it stands or travels, including the store and forward site. The software is at http://www.groove.net/home/index.cfm if you are interested. Download and install the application and let me know... I'll send an invitation that will put you into the workspace.
Thanks for your excellent discussion, Mike, and please thank your colleague for me....
Peter