FY2010 - Oak Ridge National Laboratory

Director’s R&D Fund—
National Security Science and Technology
sessions, and employ deceptions to keep an intruder engaged, allowing for both the capture of forensic
data and the extrusion of nonsensitive or misleading data in lieu of the real data. Our progress in the
active response area of this effort includes development of several components of this approach,
described as follows.
To support the quarantine of malicious remote sessions, we developed a prototype implementation of
process migration. Actively running user processes are relocated to a virtual machine where they are
insulated from the files they are attempting to steal. In order to deceive the attacker and maintain the
illusion that they are working with the real target file system, we developed a prototype for automated file
system mirroring that replicates the original file system structure but the mirrored files are 0/null padded.
Therefore, once the unauthorized exfiltration is detected, the offending process is re-mapped to the
mirrored file system to prevent the extrusion of the sensitive data.
To support the forensic analysis of malicious behaviors, we developed a means for host-based forensic
data acquisition that leverages the DTrace UNIX real-time probing capability to capture system call data.
This provides insight into the system-level operation of malicious users/processes and allows for the
identification of exemplar exfiltration behaviors.
05487
Biological Signature Identification and Threat Evaluation System
(BioSITES)
R. W. Cottingham, T. S. Brettin, S. D. Brown, and D. J. Quest
Project Description
The United States has a well-established and accomplished multiagency process dedicated to nuclear
forensics; there is no parallel process for biological forensics, underpinned by state-of the-art science.
BioWatch, the current standard in deployed biothreat detection, cannot detect genetically engineered
threats. There is a pressing need for a new system leveraging recent scientific advances to improve threat
detection. We propose a new system called BioSITES that will integrate systems biology knowledge
repositories with new data collection technologies such as high-throughput sequencing. This will enable
the construction of better detectors and provide a basis for mitigation, response, protection, and forensics
and therefore a path for future development of BioSITES and biodefense.
Newly funded initiatives are establishing ORNL as a leader in knowledgebase development for systems
biology research. Further, ORNL projects such as the BioEnergy Science Center were awarded in
recognition of the resident expertise in systems biology research and management of such large-scale
biological projects. This project leverages these core competencies toward the development of a new kind
of biodefense system required to respond to upcoming threats of the 21st century. The BioSITES
prototype will demonstrate capabilities that go beyond current deployed systems.
Mission Relevance
Implementation of the BioSITES prototype will provide the technological foundation that will allow our
team to demonstrate capabilities to the Department of Defense (DOD) and the Department of Homeland
Security (DHS) that will ultimately improve threat detection, reduce detection costs, and improve
response times. This system would be useful for both homeland security and for defending American
149