PNNL-13501 - Pacific Northwest National Laboratory

Study Control Number: PN99010/1338
Critical Infrastructure and Protection Simulator (CIPS)
Steve Ouderkirk
The Department of Energy has an urgent requirement for technology to protect its computer networks and information
systems. Neither current technology nor the computer security industry offers adequate capabilities for the level of cyber
protection expected of DOE.
Project Description
The Critical Infrastructure and Protection Simulator
(CIPS) project investigates a framework for an integral
offensive and defensive cyber environment to serve as a
model for simulating cyber events. This CIPS research
addresses a problem of national stature. It builds
additional computer security expertise at the Laboratory
to address the urgent DOE computer security concerns
and a specific new technology that could become key to a
future DOE computer security solution. The expected
research results are a cyber simulation concept that can
serve as a foundation for cyber security products, a CIPS
user facility, and certified infrastructure services to DOE.
A simulator that includes both offensive and defensive
cyber tools does not exist today. The CIPS project will
investigate this possibility and will create a proof-ofconcept
prototype to demonstrate the essential
components.
Introduction
The scope of this project was to perform research and
develop a proof-of-concept prototype tool that allows
simulation of computer and network cyber attacks
concurrently with intrusion detection tools and other
countermeasures. The objective was to create a
computational environment that allows for extensive
experiments with offensive and defensive cyber tools to
determine their effectiveness, to determine the limitations,
and to proactively explore new vulnerabilities before they
occur in the real world.
Approach
The technical approach for CIPS was to develop the
concept of a simulator for computer security and
information assurance. More specifically, CIPS provided
a framework and connectivity to leverage the many
offensive and defensive cyber tools existing today into a
single environment. Through software agents and
158 FY 2000 Laboratory Directed Research and Development Annual Report
encapsulation, it provided an environment for the
simlution of offensive and defensive cyber security
functions. The approach provided for the unfolding of
capabilities as the research progresses.
Results and Accomplishments
The intent of this project was to create the tools necessary
for creating a cyber security analysis laboratory. These
tools would comprise the roles of cyber threat source and
cyber threat mitigation. These tools would be applied to
problems with testing of security policy effectiveness,
security tool analysis, threat signature analysis, and
security training.
The coordinated attack tool is the component of CIPS that
serves as the source of cyber threats. The secondgeneration
prototype is completed. It is planned to now
be incorporated into the System Administrator Simulation
Trainer program (DoD). The coordinated attack tool consists
of two elements, a client (supervisor) that controls
the operation and servers (agents) that execute the attacks.
The client application is hosted on NT 4.0 and the server
applications can be hosted on NT and UNIX systems.
Figure 1 illustrates the coordinated attack tool process.
Current supervisor functionality includes
• an exploit library and database that includes over 900
applications and scripts
• manual initiation attacks against specific targets
utilizing one or more agents
• attacks can include combinations of exploits from the
exploit library, other exploits, and normal command
line interface system commands