PNNL-13501 - Pacific Northwest National Laboratory

User
Cat - Supervisor (client)
Analysis
Engine
File I/O
Tool
library
User Interface
Script
Engine
Database
Manager
Exploit
database
Attack
database
• attacks can be recorded, edited, and played back
• recorded attacks may be archived in a library of
attacks
• an attack scenario may be created, edited, and
executed
• the system provides a graphical display of active
agents and agent relationships
• perl scripts analyze data collected from the agents to
create a characterization of the target systems.
Current agent applications provide the following
functionality:
• communication by TCP/IP or UDP on any port
• ability to spawn or execute processes on the host
system
• ability to execute command line interface functions
on the host system
• agent scheduling for temporal coordination
• agent relay capability.
Main
Socket
Comm
Communication Layer
(TCP & UDP)
Cat - Agent (server / limited client)
Main
Socket
Comm
Figure 1. Coordinated attach tool process
Event Scheduler
File I/O System
State
Spawn
Process
Network
Resources
System
Resources
Applications
-attack tool
-attack script
- worm
-analysis engine
The Hacker Oriented Unified Network Defense System
(HOUNDS) was intended to complement the coordinated
attack tool in the simulator, serving as a locus for the
integration and analysis of system defenses. Analysis of
the major players performing research in the area of
coordinated network intrusion detection was conducted
and it was found the Intrusion Detection Working Group
was actively developing a protocol for the integration of
the various network-and host-based intrusion detection
tools that were deployed. Since this protocol would
significantly enhance the HOUNDS concept, it was
decided to defer implementation until the protocol was
finished.
In addition to the need to simulate computer security
offense and defense, we needed to provide realistic
network traffic to simulate a user base. Several venders
of network traffic analyzers were evaluated to provide this
functionality but none provided the degree of control
necessary for a viable simulation. The hardware solutions
were more appropriate for load testing and the software
solutions tended to provide only unidirectional traffic that
poorly modeled a real network. A proof-of-concept
application (TrafficBot) was developed that allows the
creation of avatars on remote systems that will mimic unidirectional
and bi-directional TCP/IP network traffic.
This traffic can consist of combinations of web browsing,
e-mail, and replay of recorded network traffic. Further
development of this will continue under the System
Administrators Simulation Trainer program.
Summary and Conclusions
The CIPS project has yielded significant results in the
creation of tools necessary for performing research in
cyber security. This capability directly resulted in the
imitation of the system administrators simulation trainer
and has allowed development of infrastructure and
personnel for future growth in the cyber security arena.
Computer Science and Information Technology 159