Search

Today's activities in cyber space are more connected than ever before, driven by the ability to dynamically interact and share information with a changing set of partners over a wide variety of networks. To support dynamic sharing, computer systems and network are stood up on a continuous basis to support changing mission critical functionality. However, configuration of these systems remains a manual activity, with misconfigurations staying undetected for extended periods, unneeded systems remaining in place long after they are needed, and systems not getting updated to include the latest protections against vulnerabilities. This environment provides a rich environment for targeted cyber attacks that remain undetected for weeks to months and pose a serious national security threat. To counter this threat, technologies have started to emerge to provide continuous monitoring across any network-attached device for the purpose of increasing resiliency by virtue of identifying and then mitigating targeted attacks. For these technologies to be effective it is of utmost importance to avoid any inadvertent increase in the attack surface of the monitored system. This paper describes the security architecture of Gestalt, a next-generation cyber information management platform that aims to increase resiliency by providing ready and secure access to granular cyber event data available across a network. Gestalt's federated monitoring architecture is based on the principles of strong isolation, least privilege policies, defense-in-depth, crypto-strong authentication and encryption, and self-regeneration. Remote monitoring functionality is achieved through an orchestrated workflow across a distributed set of components, linked via a specialized secure communication protocol, that together enable unified access to cyber observables in a secure and resilient way., Presented at the 2nd International Symposium on Resilient Cyber Systems Held August 19-21, 2014 in Denver, CO. U.S. Government or Federal Rights License

The development and validation of advanced cyber security technology frequently relies on data capturing normal and suspicious activities at various system layers. However, getting access to meaningful data continues to be a major hurdle for innovation in statistical cyber defense research. This paper describes the data challenges encountered during development of the machine learning approach called Behavior-Based Access Control (BBAC), together with mitigation strategies that were instrumental in allowing R&D to proceed. The paper also discusses results from applying a spiral-based agile development process focused on continuous experimental validation of the resulting prototype capabilities., Published in CrossTalk, p25-29, March/April 2014.

Today s business processes are more connected than ever before, driven by the ability to share the right information with the right partners at the right time. While this interconnectedness and situational awareness is crucial to success, it also opens the possibility for misuse of the same capabilities by sophisticated adversaries to spread attacks and exfiltrate or corrupt critical sensitive information. We have been investigating means to analyze behaviors of actors and assess trustworthiness of information to support real-time cyber security decision making through a concept called Behavior-Based Access Control (BBAC). The work described in this paper focuses on the statistical machine learning techniques used in BBAC to make predictions about the intent of actors establishing TCP connections and issuing HTTP requests. We discuss pragmatic challenges and solutions we encountered in implementing and evaluating BBAC, discussing (a) the general concepts underlying BBAC, (b) challenges we have encountered in identifying suitable datasets, (c) mitigation strategies to cope with shortcomings in available data, (d) the combination of clustering and support vector machines for performing classification at scale, and (e) results from a number of scientific experiments. We also include expert commentary from Air Force stakeholders and describe current plans for transitioning BBAC capabilities into the Department of Defense together with lessons learned for the machine learning community., Presented at the 32rd Military Communications Conference (MILCOM 2013) held in San Diego, CA on 18 -20 Nov 2013. Prepared in collaboration with the Department of Computer Science, Drexel University, Philadelphia, PA, and Raytheon BBN Technologies, Cambridge, MA.

Today s activities in cyber space are more connected than ever before, driven by the ability to dynamically interact and share information with a changing set of partners over a wide variety of networks. The success of approaches aimed at securing the infrastructure has changed the threat profile to point where the biggest threat to the US cyber infrastructure is posed by targeted cyber attacks. The Behavior-Based Access Control (BBAC) effort has been investigating means to increase resilience against these attacks. Using statistical machine learning, BBAC (a) analyzes behaviors of insiders pursuing targeted attacks and (b) assesses trustworthiness of information to support real-time decision making about information sharing. The scope of this paper is to describe the challenge of processing disparate cyber security information at scale, together with an architecture and work-in-progress prototype implementation for a cloud framework supporting a strategic combination of stream and batch processing., Presented at the 1st IEEE International Symposium on Resilient Cyber Systems (ISRCS) 2013 held in San Francisco, CA on 13-15 Aug 2013.

The Behavior-Based Access Control (BBAC) project seeks to address the increasingly sophisticated attacks and attempts to exfiltrate or corrupt critical sensitive information. BBAC uses statistical machine learning techniques (clustering and classification) to make predictions about the intent of actors establishing TCP connections and HTTP requests. Administrators will need to assign new computers to appropriate clusters, to be alerted about changes in cluster assignments, to select classifiers and settings to use, and to monitor accuracy of the system. We discuss the requirements and our current approach in this Interactive ML application domain., Presented at the International Conference on Intelligent User Interfaces (IUI), Workshop on Interactive Machine Learning, held in Santa Monica, CA on 19-22 March 2013. Published in the Proceedings of the International Conference on Intelligent User Interfaces (IUI), Workshop on Interactive Machine Learning, 2013.

In this BioBricks Foundation Request for Comments (BBF RFC), we specify the Synthetic Biology Open Language (SBOL) Version 1.1.0 to enable the electronic exchange of information describing DNA components used in synthetic biology. We define: 1. the vocabulary, a set of preferred terms and 2. the core data model, a common computational representation.

Engineering biological systems with predictable behavior is a foundational goal of synthetic biology. To accomplish this, it is important to accurately characterize the behavior of biological devices. Prior characterization efforts, however, have generally not yielded enough high-quality information to enable compositional design. In the TASBE (A Tool-Chain to Accelerate Synthetic Biological Engineering) project we have developed a new characterization technique capable of producing such data. This document describes the techniques we have developed, along with examples of their application, so that the techniques can be accurately used by others.

A specific and currently relevant issue motivating the notion of ruggedized software is the confluence of the threat of cyber attacks and our increased dependence on software systems in enterprise as well as tactical situations. Software services that are essential for mission success must not only withstand normal wear and tear, stresses and accidental failures, they also must endure the stresses and failures caused by malicious activities and continue to remain usable. The Crumple Zone (CZ), a software shock absorber that absorbs attack effects before they cause significant system failures, is an architectural construct that we have developed and are maturing iteratively. We argue that the CZ is an important building block for constructing ruggedized software for supporting network-centric operations. In this paper we discuss the CZ in the context of Service-Oriented Architecture (SOA) and describe a configuration that has been realized and demonstrated., Published in Crosstalk, v24 n2 p4-11, March/April 2011.

In this BioBricks Foundation Request for Comments (BBF RFC), we specify the Synthetic Biology Open Language (SBOL) Version 1.0.0 to enable the electronic exchange of information describing DNA components used in synthetic biology. We define: 1. the vocabulary, a set of preferred terms and 2. the core data model, a common computational representation.

As newer software construction paradigms like service-oriented architecture (SOA) are adopted into systems of critical importance, it becomes imperative that technology and design artifacts exist that can be utilized to raise the resiliency and protection of such systems to a level where they can withstand sustained attacks from well-motivated adversaries. In this paper we describe a sampling of innovative services and mechanisms that are designed for the protection of systems that are based on service-oriented architectures., Presented at the IEEE International Workshop on Object/component/service-oriented Real-time Networked Ultra-dependable Systems (1st), held on May 7, 2010, in Carmona, Spain. Prepared in collaboration with the Information Directorate, Air Force Research Laboratory, Rome, NY and Adventium Laboratories, Minneapolis, MN. U.S. Government or Federal Rights License

Thesis (Ph. D.)--Massachusetts Institute of Technology, Dept. of Electrical Engineering and Computer Science, 2009., This electronic version was submitted by the student author. The certified thesis is available in the Institute Archives and Special Collections., Cataloged from student-submitted PDF version of thesis., Includes bibliographical references (p. 239-243)., Interactions between people are typically conversational, multimodal, and symmetric. In conversational interactions, information flows in both directions. In multimodal interactions, people use multiple channels. In symmetric interactions, both participants communicate multimodally, with the integration of and switching between modalities basically effortless. In contrast, consider typical human-computer interaction. It is almost always unidirectional { we're telling the machine what to do; it's almost always unimodal (can you type and use the mouse simultaneously?); and it's symmetric only in the disappointing sense that when you type, it types back at you. There are a variety of things wrong with this picture. Perhaps chief among them is that if communication is unidirectional, it must be complete and unambiguous, exhaustively anticipating every detail and every misinterpretation. In brief, it's exhausting. This thesis examines the benefits of creating multimodal human-computer dialogues that employ sketching and speech, aimed initially at the task of describing early stage designs of simple mechanical devices. The goal of the system is to be a collaborative partner, facilitating design conversations. Two initial user studies provided key insights into multimodal communication: simple questions are powerful, color choices are deliberate, and modalities are closely coordinated. These observations formed the basis for our multimodal interactive dialogue system, or Midos. Midos makes possible a dynamic dialogue, i.e., one in which it asks questions to resolve uncertainties or ambiguities., (cont.) The benefits of a dialogue in reducing the cognitive overhead of communication have long been known. We show here that having the system able to ask questions is good, but for an unstructured task like describing a design, knowing what questions to ask is crucial. We describe an architecture that enables the system to accept partial information from the user, then request details it considers relevant, noticeably lowering the cognitive overhead of communicating. The multimodal questions Midos asks are in addition purposefully designed to use the same multimodal integration pattern that people exhibited in our study. Our evaluation of the system showed that Midos successfully engages the user in a dialogue and produces the same conversational features as our initial human-human conversation studies., by Aaron Daniel Adler., Ph.D.

The Air Force Research Laboratory, Space Vehicles Directorate (AFRL/RV) has developed the Demonstration and Science Experiments (DSX) mission to research technologies needed to significantly advance Department of Defense (DoD) capabilities to operate spacecraft in the harsh radiation environment of Medium-Earth Orbits (MEO). The ability to operate effectively in the MEO environment significantly increases the DoD's capability to field space systems that provide persistent global space surveillance and reconnaissance, high-speed satellite-based communication, lower-cost GPS navigation, and protection from space weather and environmental effects on a responsive satellite platform. The three DSX physics-based research/experiment areas are: 1. Wave Particle Interaction Experiment (WPIx): Researching the physics of Very-Low-Frequency (VLF) electromagnetic wave transmissions through the ionosphere and in the magnetosphere and characterizing the feasibility of natural and man-made VLF waves to reduce and precipitate space radiation; 2. Space Weather Experiment (SWx): Characterizing, mapping, and modeling the space radiation environment in MEO, an orbital regime attractive for future DoD, Civil, and Commercial missions; and 3. Space Environmental Effects (SFx): Researching and characterizing the MEO space weather effects on spacecraft electronics and materials. Collectively, thirteen individual payloads are combined together from these three research areas and integrated onto a single platform (DSX) which provides a low-cost opportunity for AFRL due to their common requirements. All three experiments require a 3-axis stabilized spacecraft bus (but no propulsion), a suite of radiation sensors, and extended duration in a low inclination, elliptical, MEO orbit. DSX will be launch-ready in summer 2010 for a likely launch comanifest with an operational DoD satellite on an Evolved Expendable Launch Vehicle (EELV).