Archive for the ‘Research Brief’ Category

Kneber Botnet – less fluxy but more stealthy

Friday, February 19th, 2010

The recent news story about the Kneber botnet based on the excellent work done by the NetWitness team and informative posts by Dancho Danchev and others brought the ZeuS Trojan botnet into limelight. In contrast to some misleading reports, the security community has been following this botnet, which infected more than 75,000 computer systems at nearly 2,500 companies, for quite a long time. We have been tracking ZeuS with our Fast Flux Monitor for some time as well. Given the recent interest in this botnet, we decided to analyze the reported ZeuS data using our Fast Flux Monitor database to provide some additional insight.

Most of the domain, nameserver and IP entities associated with the attacking infrastructure reported in the NetWitness Kneber report have been in our FastFluxMonitor database. What is interesting is that most of the reported Kneber domains and nameservers are not exhibiting fast flux behavior. For instance, all of the reported Kneber domains for the Trojan installers resolve to 1 to 4 IPs, which is not enough for using a fast flux evasion scheme. The number of domains the Kneber Trojan installers resolve to are shown in the table below.

ZeuS Installer.jpg

Comparing the ZeuS network graph with the various botnets in our database reveals that ZeuS botnet has a different network graph than others like Avalanche, Conficker, Gumblar and Pushdo. The figure below shows the domain, nameserver and IP connectivity for the Avalanche botnet:

ffm_avalanche_network.jpg

In this graph, the blue, red, green nodes denote the IPs, domains, and nameservers addresses, respectively. Each cluster represents a set of entities where any two nodes can be linked through the domain, nameserver and IP connectivity . The Avalanche graph has one large cluster and six small clusters, making it easy to discover the various entities of this botnet. In contrast, the same graph for the ZeuS botnet shown below has one large cluster and over 200 small clusters, thus making it hard to discover the various entities of this botnet.

ffm_zeus_network jpeg.jpg

Referring to the data shown in the table above, the reported Kneber domains and nameservers belong to one of the small clusters on the right. These clusters consist of domains and nameservers that do not exhibit fast flux behavior. Whether the small clusters represent the discreet probe of networks by large criminal organizations, or small operator hosting set-ups that downloaded free phishing kits, the ZeuS botnet is stealthier than the others by relying on a large number of smaller clusters used for attack campaigns.

We will present our comparative analysis of the Avalanche, Conficker, Gumblar, Pusdhdo, and ZeuS at the NATO IST-091 Symposium on “Information Assurance and Cyber Defence”, which will provide an explanation for the difference.

Concept Map vs. PowerPoint for Briefings

Wednesday, November 25th, 2009

What has PowerPoint given the knowledge worker besides universality? PowerPoint features like automatic generation of slides from outlines, structured knowledge constructs like tables, graphs, and charts support knowledge organization and communication. Although most PowerPoint features have been available since the early days of Mac software such as MORE and Cricket Graph, it is the ubiquity of PowerPoint that created a backlash against the uniformity it imposes on thinking, organizing , sharing of knowledge concepts. In his essay The Cognitive Style of Powerpoint: Pitching Out Corrupts Within, Edward Tufte argues that PowerPoint templates weaken verbal and spatial reasoning, and corrupt statistical analysis by analyzing the NASA briefings preceding the Columbia disaster.

In the government space we serve, the situation is not different. As reported in the Wall Street Journal, PowerPoint has become an ingrained part of the defense culture. For instance, PowerPoint Ranger is now a derogatory term used for a military professional who excels in slidemaking than warfighting. In fact, Margaret Hayes at the National Defense University posits that “You can’t speak with the U.S. military without knowing PowerPoint.” In the Armed Forces Journal essay, Dumb-dumb Bullets, T. X. Hammes goes further to argue that PowerPoint is “actively hostile to thoughtful decision-making”, and has “decreased the quality of the information provided to the decision-maker”.

From a cognition perspective, would you ask a first grader to build a PowerPoint presentation to see their grasp of a concept? No. Luckily for us, thanks to the pioneering work of Joseph D. Novak at Cornell and others, there is something that educators are using for such assignments in K-12 and higher education: Concept Maps. A concept map is a graphical network diagram where each node represents a concept, and the labelled links depicts the relationships between concepts. Here is a concept map that describes what a concept map is.

CMap of Concept Maps.tiff

What is special about this representation? The teacher sees the limitation of the student’s understanding, and multiple students can collaboratively build a concept map for shared understanding. Is that possible in PowerPoint? No. It is simply not possible to assess an author’s level of understanding of the subject domain from a PowerPoint deck as lack of communication skills often masks the knowledge gaps in the underlying domain.

As articulated by Joseph D. Novak, meaningful learning involves the assimilation of new concepts and propositions into existing cognitive structures. What this means that the viewer needs to first identify her/his known cognitive map of the presented concept and then detect the additions to this concept map for true learning. In other words, the viewer of a presentation always tries to find the answers to the following questions:

  • What do I already know in the presented topic?
  • What are the additional knowledge chunks that complement what I already know?
  • Can I trust the presented addition to my knowledge base?

On answering these questions, concept maps trump PowerPoint presentations, which explains their popularity in learning environments. Concept mapping is not a religion espoused by some education crusaders as the effectiveness of concept maps has been studied empirically. In an experiment conducted at the Naval Postgraduate School, Concept Maps were empirically demonstrated to be more effective than PowerPoint on key measures of knowledge transfer and rapidity in creation. In an anonymous survey at the American University in Cairo, a majority of students stated that doing concept maps required them to look at the assigned reading in more depth. A study conducted at a nursing school in Bangkok, Thailand showed that concept mapping is effective in assisting nursing students to summarize their own concepts and improve their nursing core competency in primary medical care.

There are other advantages of using Concept Maps in presentations. Jim Benson in his blog post makes the interesting point that concept maps create a continuous conversational flow with no breaks while noting that PowerPoint creates an unhealthy distraction of “What’s coming next?”. Steven Kaminski writes that most business PowerPoint presentations, with a little extra work, would be better—even much better—without it because the speaker becomes an audio aid for the PowerPoint slides instead of the presentation being a visual aid for the speaker, which is the case for concept maps.

In addition to several commercial software packages, there are several open source concept mapping tools. The Visual Understanding Environment (VUE) project at Tufts, and CMap Tools at the Institute of Human and Machine Cognition (IHMC) have large active community of users. We don’t have to wait until Concept Maps become a part of the Microsoft Office suite to start using them. Do we?

Semantic Annotation for Knowledge Management

Sunday, October 4th, 2009

Do you remember your annotation home-works from literature courses? Researching the qualifications of an author, figuring out the topic, tone, rhetorical strategy, audience, and purpose of an essay, or thinking about the connections between what you just read and other work in the field … Imagine everyone being able to put such facts and relations into a machine understandable form and having machines harvest those relations on our behalf. That is what semantic wikis enable.

Semantic annotation defines the domain concepts and relations between concepts. Formally, an annotation is a tuple consisting of annotation (subject, object, relation, and context) as defined in “Annotation and Navigation in Semantic Wikis” by Eyal Oren et al. Our Semantic Wiki for Complex Operations uses Semantic MediaWiki, that allows annotations to a wiki page. For instance the insurgency page has the following annotation:

* [[has characteristic::Popular Support]]

Here the subject of the annotation is the ‘insurgency’ concept represented by this wiki page, ‘has characteristic’ is the annotation relation, and ‘popular support’ is the object of the annotation. While Semantic MediaWiki only allows single level annotations of wiki pages and does not formally separate the page and the concept it represents, we think it still serves as the widely adopted standardized semantics syntax necessary for semantic wiki applications to take off.

Annotation clearly introduces an additional burden on the knowledge worker. So unless the return on investment on semantic annotation provides value to the community that the wiki serves, it would be hard to expect widespread adoption. Semantic MediaWiki extensions provide such value. Again referring back to our Semantic Wiki for Complex Operations, the wiki page for each social science data set (e.g. Minorities at Risk Project Dataset, CIRI Human Rights Data Project, etc.) is annotated by using the built-in ‘category’ attribute:

Category: Dataset

That is, each social science dataset in our Complex Operations wiki is annotated to be of category dataset. Clicking on the link Dataset above gives a table that lists currently avaiable social science datasets in our wiki:


Table.tiff

In a traditional wiki, this table needs to be manually specified by:


wiki syntax.tiff

In contrast, semantic annotation enables us to generate this table dynamically using only one statement in Semantic MediaWiki:

{{ #ask: [[Category:Dataset]]

| ?title

| ?year }}

As this example illustrates, semantic annotation provides a significant ROI to the knowledge worker in knowledge organization. Moreover, when a researcher adds another dataset to our wiki, this table will automatically include the new dataset, thus improving knowledge maintenance.

Semantic Wikis for Communities of Practice

Monday, September 28th, 2009

The term community of practice (CoP) was coined by Jean Lave, a social anthropologist. Its value in learning was popularized by Etienne Wenger, an educational theorist. CoP denotes a group of people who share a passion about a common topic, and deepen their knowledge and expertise in this domain by interacting with each other on an ongoing basis. According to Etienne Wenger, a community of practice defines itself along three dimensions and its characteristics can be captured by:

The domain. A community of practice is is something more than a social network. “It has an identity defined by a shared domain of interest. Membership therefore implies a commitment to the domain, and therefore a shared competence that distinguishes members from other people”.

The community. “In pursuing their interest in their domain, members engage in joint activities and discussions, help each other, and share information. They build relationships that enable them to learn from each other”.

The practice. “Members of a community of practice are practitioners. They develop a shared repertoire of resources: experiences, stories, tools, ways of addressing recurring problems—in short a shared practice. This takes time and sustained interaction”.

In developing and nurturing Communities of Practice, Etienne Wenger talks about the diverse and distributed internal leadership:
• The inspirational leadership provided by thought leaders and recognized experts
• The day-to-day leadership provided by those who organize activities
• The classificatory leadership provided by those who collect and organize information in order to document practices
• The interpersonal leadership provided by those who weave the community’s social fabric
• The boundary leadership provided by those who connect the community to other communities
• The institutional leadership provided by those who maintain links with other organizational constituencies, in particular the official hierarchy
• The cutting-edge leadership provided by those who shepherd “out-of-the-box” initiatives.
McDermott goes further and states learning is in the relationships between people:

Learning traditionally gets measured as on the assumption that it is a possession of individuals that can be found inside their heads… Learning is in the relationships between people. Learning is in the conditions that bring people together and organize a point of contact that allows for particular pieces of information to take on a relevance; without the points of contact, without the system of relevancies, there is not learning, and there is little memory. Learning does not belong to individual persons, but to the various conversations of which they are a part.

In the book Seven Principles for Cultivating Communities of Practice, Etienne Wenger, Richard McDermott, and William M. Snyder argue that while communities of practice develop organically, a carefully crafted design can drive their evolution. Here are the seven principles:
1. Design for evolution
2. Open a dialogue between inside and outside perspectives
3. Invite different levels of participation
4. Develop both public and private community spaces
5. Focus on value
6. Combine familiarity and excitement
7. Create a rhythm for the community

There is additional research on what makes online CoP’s flourish. Jennifer Preece posits that etiquette, empathy and trust in communities of practice can be developed by understanding people’s needs; representing the community’s purpose clearly; putting minimalist policies in place that can be changed as norms develop; supporting knowledge creation, exchange and storage; supporting communication and socialization online; encouraging empathy by enabling participants to recognize each other and their similarities; supporting trust by ensuring that identity is revealed and past behavior is tracked.

In the paper Learning with Semantic Wikis, Sebastian Schaffert and his colleagues lists the benefits of semantic wikis in the learning process. First, they argue that semantic annotations lead to reflection about knowledge. For instance, the student needs to reflect on the content while reorganizing the wiki material. In fact, the teacher can assess the student’s progress by analyzing the change history. Second, semantic Wikis enable the teacher and students to share formal models, and build of a common model collaboratively. Finally, reasoning and inference capabilities of Semantic Web technologies can lead to discovery of knowledge without active user search. In the paper Using a Semantic Wiki in Communities of Practice, Adil El Ghali and his colleagues articulate the advantages of adding semantics to wikis like semantic search and navigation, a more intuitive interface, intelligent awareness, tagging, folksonomy management, linking CoP content to external resources, etc.

The development of Communities of Practice is the charter of Army Knowledge Online. Here is a paper and related presentation that articulates the thrust in DoD. We are in the process of putting these ideas into practice in our Semantic Wiki for Complex Operations project.

The Inheritance

Thursday, June 18th, 2009

Perhaps now more than at any other time in our nation’s history, the United States faces a multitude of strategic threats and challenges. Rogue regimes, militant Islamist networks, and changing power balances from rising nations such as China, to failing states such as Pakistan, threaten to upend the security and stability of the United States. 

 

As a research assistant for The Inheritance: The World Obama Confronts and the Challenges to American Power, a book by David E. Sanger, Chief Washington Correspondent for The New York Times, I had the opportunity to dive deep into issues ranging from Chinese military modernization to cyber-security to the Iranian nuclear program. My research took me into the Pakistani nuclear establishment and the militant threat emanating from the tribal areas to the post-invasion environment in Afghanistan and the personalities shaping the debate on counterinsurgency in the post-9/11 world. 

 

The democratization of technology involving nuclear materials, cyber-attacks, and biological agents, has provided non-state actors access to weapons that were previously the purview of states. The multifaceted nature of these complex issues will require greater interagency cooperation and knowledge transfer, in particular in the civil-military field. Securing the homeland from the threat of radiological weapons will require a robust intelligence effort abroad to root out shadowy networks dealing in such materials, such as those of A.Q. Khan, increased focus on securing at-risk facilities in Russia and the former Soviet states through initiatives like Cooperative Threat Reduction, and increasing collaboration between the scientific community and government entities such as the Domestic Nuclear Detection Office to bring cutting edge research and technology to the detection of radioactive materials crossing our borders. 

 

In the cyber-security realm, bolstering public-private partnerships between government entities such as the military and intelligence community, and corporations, financial institutions, and public utilities, often the targets of cyber-attacks, will be important in developing detection and response capabilities and formulating comprehensive rules of engagement. In addition to the military component of COIN operations, civilian teams specializing in security-sector reform, judicial and political affairs, economic development, and infrastructure, will be operating in the battlespace to bolster host government legitimacy, the center of gravity in the campaign. Given the shared responsibilities in the civil-military field on these issues, fostering knowledge integration and cooperation between the various branches of government, military, and civilian stakeholders is of paramount importance to ensuring unity of effort. 

 

The Inheritance is a researched-backed analysis of the challenges we currently face, a legacy of the opportunities missed after 9/11.  While I may be biased because of my involvement with the book, I strongly recommend it to anyone interested in understanding the challenges confronting Obama and the complexities of the geopolitical environment. 

Milcord extends Political Instability Task Force model to insurgency forecasting

Tuesday, January 27th, 2009

Using the COIN and Stability Operations Field Manuals as a process model, Milcord’s [[Predictive Societal Indicators of Radicalism]] (PSIR) analytical model predicts future radicalization based on current and historical societal indicators by finding the causal relationships between governance, economic, grievance, essential service indicators, and radicalization metrics. Find out more about our [[PSIR]] project.

Forecasting Traffic

Tuesday, November 25th, 2008

Milcord extends its [[risk-based route planning]] solution to handle forecasted traffic patterns, social and cultural events. The model forecasts future environment from current conditions and historical data and optimizes the mission utility based on the forecasted conditions, thus enabling an agile capability for [[Sense and Respond Logistics]].

Personalized Web 2.0 Service for Authoritative Content

Monday, June 30th, 2008

How can you separate authoritative content from the rest on the Internet? With support from the Department of Energy (DoE), Milcord announced a Web 2.0 Service that will accelerate discovery and collaboration in the R&D community by making it easier for scientists and researchers to collaborate and find authoritative and trusted sources of scientific blogs, podcasts, videos, and documents, and by making it easier for scientific publishers to syndicate their content. Find out more about our [[Personalized Web 2.0 Service for Authoritative Content]] project.

Milcord in C4ISR – The Journal of Network-Centric Warfare

Wednesday, July 4th, 2007

Ross Stapleton-Gray discusses “How to Reclaim Computer Networks from Botnets” with particular insight into the cyber attack on Estonia.

Alper Caglayan is the principal investigator at Milcord LLC of Waltham, Mass., which, with the University of Wisconsin and its Wisconsin Advanced Internet Laboratory, was one of the HS-ARPA’s STTR awardees. Milcord’s approach is aimed at reducing the overall bot “ecosystem,” which would reduce their availability for use in attacks such as that conducted against the Estonian Internet sites.

“Our product probably would help Estonia indirectly,” Caglayan said. “If ISPs and corporate networks were using our product to detect and mitigate infected computers, the attacks on Estonia’s government resources would be much less effective. Our goal in this project is not so much to stop systems from being infected, but to detect the infection as soon as possible, then to mitigate the infection.”

Read more about our [[Botnet Defense]] project.

Milcord at MobiSensors’07

Wednesday, January 31st, 2007

Milcord presented a position paper titled “A Commercial Perspective: Collaborating on Application Prototypes as an
Infrastructure Provider”
at the NSF Workshop on Data Management for Mobile Sensor Networks (MobiSensors).

Sensor data management and fusion is a technical component in a number of
our projects across a range of applications and technologies, including:
· Monitoring [[SPE|Earth Science]] Data – NASA
· [[GEMI|Intelligent Video Surveillance]] – Army
· Enemy [[Course of Action Forecasting|Course of Action]] Analysis – Army
· Quality of Service in Tactical Networks – Air Force
· [[Botnet Defense|Botnet Detection]] and Mitigation – DHS