PARIDINE_-_Industry_Day_Final.pdf

Dr. Ann Cox

Program Manager Cyber Security Division Science and Technology Directorate

Application of Network Measurement Science

Predict, Assess Risk, Identify (and Mitigate) Disruptive Internet-scale Network Events (PARIDINE)

Industry Day May 25, 2017

Current Capability and Research Needs

Research in such areas as Network Mapping and Measurement, Resilient Systems, Network Attack Modeling and Embedded System Security is essential for protecting critical infrastructure throughout the United States and the world.

Progress in these areas has identified a need to understand and address issues related to widespread Disruptive Events to the Internet For Disruptive Events on the Internet, there is no standard definition, identification, or reporting process currently available. This makes prediction and attribution especially difficult.

Overview Network Measurement Science is the efficient and principled application of scientific principles to network measurement

The Guardian: Damaged undersea cable causes widespread service disruption

NY Times: A new era of internet attacks powered by everyday devices

USA Today: Hacked home devices caused massive internet outage

CNET: Internet outage swoops in and out of US this morning

Status Quo: Network Measurement Science Today

There are many individual measurements and tools, such as ping, traceroute in various versions, NetFlow, packet sampling, etc. but the data are rarely combined for more accurate analysis

Techniques for fusing data and analysis of the fused data are generally not available

Attribution analysis is still in its early development

Status Quo: With Prediction, Identification, Attribution and Reporting of NIDEs

Shifts advantage toward defenders through identification, attribution, and reporting of Network/Internet Disruptive Events

• Network/ Internet Disruptive Events (NIDEs) are identified

There are many individual measurements and tools, such as ping, traceroute in various versions, NetFlow, packet sampling, etc. but the data are rarely combined for more accurate analysis

• Identification and reporting of NIDEs is made in near real time

Techniques for fusing data and analysis of the fused data are generally not available

• Some attribution analysis will be availableAttribution analysis is still in its early development

Problem: Internet Disruptive Events

The measurement and monitoring that currently takes place is →

Government level, may be classified data ↓

Private sector, proprietary data Academic, limited in scope

The internet is vast and extremely difficult to “monitor”.

Although many efforts to make individual measurements exist, they are limited in scope, and cannot detect or communicate Network/Internet Disruptive Events (NIDEs) until the event has already occurred.

Problem: Advantage Favors Chaos

•Resources Costs Favor Attackers •Attacks require fewer resources because they can be narrowly focused, whereas defenders must spread resources to cover all attack surfaces •The size and scope of the internet allows small malicious actions to go undetected

• Problems may be caused by deliberate or accidental events, or as an unintended consequence of some other benign effort

•May exploit unknown vulnerabilities •Will not be anticipated through monitoring

•Proprietary networks and a highly competitive environment discourage information sharing and broad based defense

•The development of systems to identify, monitor, attribute, and communicate NIDEs will encourage best practices and allow for a more uniform resiliency

Validation through Gaps/Alignment PARADINE Program Aligned to DHS

Priorities

This effort addresses one of the Five Basic Homeland Security Goals, “To safeguard and Secure Cyberspace,”

This also effort addresses DHS S&T Visionary Goal #2 Trusted Cyber Future: Protecting Privacy, Commerce, and Community, This effort addresses the IPT Technology gaps in Cybersecurity:

ICS Control Systems, Cyber Sensors, Analytics, and Prevention

Capabilities Lack of Cybersecurity Effectiveness, Severity, and Comparative

Metrics

TTA 1: Definition, Identification and Reporting of Network/Internet Disruptive Events

• Define a Network/Internet-scale Disruptive Event (NIDE) in terms of quantifiable metrics and classifications, as well as documenting required sensors and data to measure the NIDEs, and produce a NIDE Identification Document.

Definition and identification of Network / Internet Disruptive Events (NIDEs)

• Develop an analysis methodology and techniques to sense and identify NIDEs, preferably for identification in near-real-time, and document the results in an NIDE Analysis Framework Document. Develop operational code for NIDE reporting.

Reporting and operational production of Network / Internet Disruptive Events

• Building on creating the NIDE identification document and NIDE analysis Framework document, create an interface to serve as a data source for external tools or additional analysis.

Develop an API for communication of the identification, attribution and reporting of NIDEs

This TTA leverages the techniques in TTA 1 to identify NIDEs and develop a framework to attribute NIDEs

• NIDE attribution methodology

• Develop a methodology for attributing NIDEs including a framework to capture the confidence in the attributions. Root cause analysis is a desired outcome.

• Develop a methodology to validate NIDE attributions

• The validation process will identify the data sources used and provide a detailed analysis of how close the NIDEs matched the observed NIDE attributions.

• API for the communication, identification, attribution and reporting of NIDEs

• Building on the NIDE reporting methodology and associated NIDE identification and attribution validation, the third goal of TTA 2 is to create an interface that can provide data to external tools for further assessment

TTA 2: Attribution of NIDEs

Adoption by Government/Private Sector

These types of tools, reports and knowledge products have been of great interest to the US Coast Guard, The Federal Trade Commission (FTC) the Federal Communication Commission (FCC), The Federal Aviation Administration (FAA), the Defense Information Systems Agency (DISA), and the Palm Beach County 911

The NIDE results may be combined with other information and tools, some of which have been developed by the IMAM program, and used to create pilot programs.

Transition Targets

Program Objective & Timeline Technical Topic Objective Timeline

TTA 1: Definition, identification and reporting of Network/Internet Disruptive Events

(NIDE)

Develop a methodology for defining, identifying and reporting of NIDEs, including a framework to capture the confidence in the reports and assign a time horizon.

• 3 months – NIDEs definition finalized

• 6 months – NIDES identified using the methods in the proposal, along with any information or metadata associated with the NIDE that is sharable.

• 12 months – Develop and validate metrics for successful identification and dissemination of NIDEs

• 18 months – Tools for reporting of NIDEs and confidence metrics expressing the reliability of the produced attribution hypothesis

• 24 months – Operational Software

TTA 2: Attribution of NIDEs

The attribution of NIDEs, including root cause analysis.

The validation process will identify the data sources used and provide a detailed analysis of root causes with a measure of confidence in the attribution.

• 6 months – Analysis algorithms/methodology for prediction and attribution of NIDEs

• 12 months – initial attribution for NIDES

• 15 months – Root cause analysis available

• 18 months - NIDE attribution sharing capability

• 24 months – Attribution validation

Schedule and Milestones Year 1 Year 2 Year 3

Pilot Option for TTA 2

Pilot Option for TTA 1

TTA 1: Definition, Identification and Reporting of NIDES

TTA 2: Attribution of NIDEs

Key - Technical & Managerial Events:

Kickoff – once >60 days after award Go/No-Go Demo – once per year Review/PI Meetings – quarterly CSD PI Meeting – once per year but TBD

Pilots – Optional pending also Government Customer

Other Programmatics

Anticipated Period of Performance is 2 years An additional one year option for pilots (total of 3 years) is pending a Government customer.

Anticipated annual funding is up to $1M per performer

Program budget will not be released

Number of anticipated performers is not known

Technical approaches will need to provide specific metrics to meet the program objectives and milestones along with a timeline

Event Time Due Date or Date Due Industry Day N/A May 25, 2017 Proposals Due 4:30 PM EDT July 14, 2017 Notification of Proposal Selections

4:30 PM EDT September 15, 2017

This BAA intends to significantly advance the critical area of Applied Network Measurement Science NIDEs are an ongoing phenomenon and the opportunity to detect and report them will be continuous. Application of the developments from this program to the “real world” will be a low cost reality check to the program available whenever required. If the customers for the cyber systems provide positive feedback and wish to continue and maintain the service, then it will be an important indication that this program is successfully addressing this urgent need.

Summary