Proceedings of the 11th European Conference on Information ...

ficient to disconnect <strong>the</strong> server that is <strong>the</strong> target <strong>of</strong> <strong>the</strong> DoS attack. When
prosecuting an attack, adversaries must always contend with limited resources
and time. In order to integrate cyber operations in constructive
simulations with a measure <strong>of</strong> realism, <strong>the</strong> paper will discuss a mechanism
to limit <strong>the</strong> cyber attacks available to an attacker in terms <strong>of</strong> available resources
and time. The approach will also introduce <strong>the</strong> concept <strong>of</strong> stochastic
attack success by assigning probabilities <strong>of</strong> attack success against known
defences. Finally, <strong>the</strong> paper will discuss avenues <strong>of</strong> future and related
work, including <strong>the</strong> relationship <strong>of</strong> this work with <strong>the</strong> Metrics Framework
for Cyber Command and Control paper, (Bernier et al. 2012) also presented
at this conference.Keywords: cyber operations, constructive simulation,
education, cyber effects, military operations
A Taxonomy <strong>of</strong> Technical Attribution Techniques for
Cyber Attacks
Andrew Nicholson, Tim Watson, Peter Norris, Alistair Duffy and Roy Isbell
De Montfort University, Leicester, UK
Abstract: In recent years <strong>the</strong> number <strong>of</strong> cyber-attacks has dramatically
increased, affecting military, government, business and home users. For
example, <strong>the</strong> UK Ministry <strong>of</strong> Defence claims to have blocked and investigated
over 1000 serious cyber-attacks in 2010 while in 2011 Detica reported
that <strong>the</strong> cost <strong>of</strong> cybercrime in <strong>the</strong> UK is estimated to be £27 billion per
annum. In cyber-attacks numerous methods exist that can be used to discover
information about <strong>the</strong> attacking entity, o<strong>the</strong>rwise termed as attribution.
Attribution is a desired quality to counter a variety <strong>of</strong> attackers.
Cyber-crime attribution can aid police investigations in identifying cyber
criminals. In cyber warfare and conflict an attribution capability is desired
to enhance decision making <strong>of</strong> Computer Network Operations (CNO). Attribution
<strong>of</strong> terrorist cyber-attacks may help to prevent future attacks.
Highly publicised attacks such as Stuxnet and Night Dragon have been subject
to intense analysis, yet published attribution <strong>of</strong> <strong>the</strong>se attacks has been
minimal. The complexity <strong>of</strong> reliable attribution is increased by an attacker’s
ability to route attacks through compromised systems, anonymised networks,
proxy servers and various jurisdictional boundaries. There are numerous
technical attribution techniques ranging from traceback, malware
inspection and honeypot deployment. In this paper we present a taxonomy
23