FY2010 - Oak Ridge National Laboratory

Director’s R&D Fund—
National Security Science and Technology
mitigate the advantages attackers gain through intrusion by identifying malicious behaviors on each host
computer. It is expected to provide the capability for an organization to detect and respond to
unauthorized exfiltration attempts.
Mission Relevance
Data exfiltration is a pressing government and commercial concern. There are numerous publicly reported
instances of sensitive data being stolen from both government and industry entities and either exposed
publicly or funneled to groups that will maliciously exploit the data. Unlike other tools that focus on
detection at the network perimeter, this work focuses on a host-based exfiltration detection system that
analyzes behaviors of users and processes. It addresses a need for exfiltration detection within a targeted
network, should an intruder successfully breach the perimeter defense. To date, there are no host-based
tools that automate both the reliable detection of data exfiltration activities and the invocation of the
dynamic honeypot response.
The successful completion of this research will position ORNL and DOE to become a leader in data loss
prevention. The data exfiltration detection and dynamic honeypot elements of this work support the
mission of the Cyber Security Protection Program in DOE's National Security Department, the Cyber
Security Program Area of the Department of Homeland Security's Command, Control and Interoperability
Division, as well as the newly formed U.S. Cyber Command.
Results and Accomplishments
During this first year of the project, we focused on the data exfiltration detection and response
capabilities. The paragraphs below summarize the accomplishments in each of these areas.
Unauthorized data exfiltration detection. With the wealth of data that is available on a computer host, we
investigated three different approaches to characterizing anomalous behaviors in users and processes.
The first approach dealt with the analysis of host log files and extracting relevant data from the volumes
of log messages produced during a computer’s operation. We developed and implemented an algorithm
that leverages s-grams and temporal clustering to identify those significant events in host log files. On
average, the algorithm discarded 99.2% of the log file data while still identifying the relevant log
messages. An invention disclosure for this algorithm is in development.
Our second approach to exfiltration detection was to extract and analyze data at the kernel level of
computer operation in order to characterize user and process behaviors. We developed and implemented a
model for identifying anomalous user behaviors by analyzing sequences of system calls. The model
characterizes normal behaviors by maintaining a library of normal sequences and alerts on sequences that
are not captured in the library. This approach was tested and found to be a viable discriminator of
anomalous user and process behaviors. A conference paper has been submitted detailing the results.
Our third approach was focused on a method to fuse data from multiple sensors into a reliable detector of
unauthorized data exfiltration behaviors. The challenge in this piece is to discriminate data exfiltration
behaviors from normal behaviors. Progress made with this fusion approach includes the development and
implementation of a large-scale complex temporal pattern discovery algorithm that is driven by an
evaluation of discrimination power. Evaluation of this algorithm’s performance is expected in the coming
year of work.
Active response through dynamic honeypots. The focus for the active response element of this work was
to develop the software infrastructure for performing real-time response actions. Our approach to active
response for data exfiltration events is to secure the sensitive data by quarantining malicious user
148