The volume of network traffic and elusiveness of modern cyber threats challenge the ability of cyber analysts to identify anomalous behavior in networks. In this work, we propose an autonomous agent to enhance analysts’ detection capabilities. To this end, we designed an agent to analyze feature-rich network traffic by autonomously executing the Data Analytic Development Process: (1) data engineering–prepares datasets, (2) feature engineering–selects the most representative features, (3) model engineering–chooses the best algorithm-feature combination, and (4) analytic deployment–applies the optimized analytic to the dataset and identifies anomalous behavior. We refer to this agent as an Autonomous Data Scientist (ADaS), utilizing reinforcement learning as an orchestrator to determine the optimal combination of features and unsupervised clustering algorithm. ADaS operates without labeled training data, and results on popular public datasets (NB15, IoT-23, and KDD’99) demonstrate high detection and low false alarm rates, making it reliable and novel for anomaly detection.

Today, many organizations’ cyber defense and re-siliency strategies rely heavily on the use of Intrusion Detection Systems (IDS) for the identification of cyber attacks. However, one downside of these systems is their reliance on known attack signatures for proper training and detection. As cyber-attacks become more sophisticated, their behavior can be difficult for IDS to learn and predict, as malicious behavior is often multifaceted. This makes it difficult to create and train robust IDS, as these qualities often lead to both high false positive and low detection rates. The next generation of IDS have been established as autonomic cybersecurity systems, and in this paper, we focus on improving the detection capabilities of these systems by applying our Survival Analysis technique, which helps to identify features that may contribute to missclassifications. To demonstrate the utility of our work: (1) we implement an Autonomic Cybersecurity system using multiple micro-intrusion detectors, that aggregate the results, and decides if the system has experienced anomalous behavior or not, (2) apply our threat model, (3) and review detection capabilities before and after applying our technique. Our results show that our approach, Autonomic Cybersecurity enhanced with Survival Analysis (ACSeSA), makes slight improvements in the detection capabilities of decision tree classifiers and even greater improvements for other types of classifiers such as linear regression and SVM.

Passengers of peer-to-peer ridesharing services, such as Uber, need assurance that the driver picking them up is the authorized vetted driver. Ridesharing accounts can be shared or stolen by rogue drivers, compromising the safety of passengers. In this paper, we propose a behavior-based driver authentication scheme that enables transparent continuous verification of a driver, instead of relying on one-time account login authentication. We leverage data from smartphone and vehicle sensors to compile a profile or “fingerprint” of the driver's behavior while operating the vehicle. To assess the practicality of the proposed method, we conducted an experimental evaluation to test the ability to distinguish and identify different drivers. Results show that we achieve a driver identification rate of 76.67% to 100% across different experimental scenarios.

Business demand for bring your own device (BYOD) or guest wireless networks will continue to increase, and enterprise security programs must change to enable and secure this new environment with mobile devices. In this paper, our aim is to demonstrate an intrusion detection alternative that can identify infected mobile devices that either produce no application-sourced Wi-Fi network traffic or highly disguise their Wi-Fi network traffic. We evaluate the detection capability of this tool by attempting to discern non-infected Android mobile devices from Android mobile devices that have been infected by Trojan-based malware. Our approach has two major contributions. (1) It is a network-based tool that does not need to be installed on a device, unlike anti-virus software that can be subverted by malware. (2) Results demonstrate that the network-based tool is capable of accurately detecting a class of malware that does not generate Wi-Fi network traffic or highly disguises its Wi-Fi network traffic.

This work introduces a novel security framework for wireless sensor networks (WSN) based on dynamic duty cycle, which allows nodes to detect their compromised neighbors based on unanticipated fluctuations in network traffic send rate over time. Our framework was assessed by its ability to detect advanced WSN threats (e.g., active, passive, or both attacks). One of the benefits of this framework is that it reduces all threats to unanticipated power dissipation. In other words, the framework assumes any neighbor not conforming to predicted power levels has been communicating with an unauthorized node, and thus is compromised. This threat model is emulated by applying pseudo random but bound (large to small) power dissipations to arbitrary nodes. Simulation results demonstrated that this framework was effective in detecting and isolating compromised sensor nodes.

This paper presents a method of device type verification via network behavior examination. This work is compared to methods and applications like nMap or xProbe, because it is capable of discerning mobile operating systems (OS) by using both active and passive network traffic. Our approach, which is based on repeatable experiments, suggests that the three major mobile OS vendors (i.e., Android, iOS, and Microsoft) down throttle the network response of some network traffic sent to them (e.g., ICMP pings) or requested by them (e.g., streaming TCP/IP) in different ways, likely to conserve battery power. Consequently, it affects the network behavior of the devices and how they handle certain events. We took the following steps as a proof-of-concept: (1) ICMP packets are actively sent to (i.e., ping) or (2) passively received by (i.e., streaming video) Android, iOS, and Microsoft mobile devices, (3) the resulting network traffic is analyzed, and (4) machine learning methods are trained to discern among the three OS types. We demonstrate that this method works well using either actively or passively generated network traffic. This method is more flexible than methods that rely solely on MAC addresses or other historical analysis methods for the identification of mobile OS type.

This paper presents a method of device type verification via network behavior examination. This work is compared to methods and applications like nMap or xProbe, because it is capable of discerning mobile operating systems (OS) by using both active and passive network traffic. Our approach, which is based on repeatable experiments, suggests that the three major mobile OS vendors (i.e., Android, iOS, and Microsoft) down throttle the network response of some network traffic sent to them (e.g., ICMP pings) or requested by them (e.g., streaming TCP/IP) in different ways, likely to conserve battery power. Consequently, it affects the network behavior of the devices and how they handle certain events. We took the following steps as a proof-of-concept: (1) ICMP packets are actively sent to (i.e., ping) or (2) passively received by (i.e., streaming video) Android, iOS, and Microsoft mobile devices, (3) the resulting network traffic is analyzed, and (4) machine learning methods are trained to discern among the three OS types. We demonstrate that this method works well using either actively or passively generated network traffic. This method is more flexible than methods that rely solely on MAC addresses or other historical analysis methods for the identification of mobile OS type.

A wireless covert timing channel (WCTC) is an established method of concealing information within a wireless medium for the purpose of covert communications. The pervasive use of mobile devices motivates our exploration into the potential of a two-way WCTC suitable for peer-to-peer (P2P) malware, in order to raise early awareness to the threat. In this work, we demonstrate the efficacy of a two-way WCTC over local networks, the public Internet, and cellular networks. Such network scalability in a mobile-to-mobile WCTC would make the notoriously hard-to-defeat P2P command-and-control (C&C) structure a viable option for currently prevalent families of mobile banking and ransomware Trojans. Specifically, we developed an Android application with the capability to communicate with other instances of the application over local networks, the Internet, and mobile networks via a WCTC. We demonstrate the feasibility of this application through experiments that test its accuracy, speed, and overall effectiveness. The main concern is that our endpoint applications could easily be replaced with malware and P2P C&Cs. The likely result is that very-difficult-to-detect malicious network traffic would emerge, especially since popular intrusion detection systems, like Snort and FireEye, have no inherent mechanisms to detect WCTCs.

In this article, we illustrate that the boundary of a general-purpose node can be extended into the network by extracting information from network traffic generated by that general-purpose node to infer the state of its hardware components. This information is represented in a delay signature latent within the network traffic. In contrast, the traditional approach to determine the internal state of a node’s resources meant that a software application with internal processes had to be resident on the node. The aforementioned delay signature is the keystone that provides a correlation between network traffic and the internal state of the source node. We characterize this delay signature by (1) identifying the different types of assembly language instructions that source this delay and (2) describing how architectural techniques, such as instruction pipelining and caching, give rise to this delay signature. In theory, highly utilized nodes (due to multiple threads) will contain excessive context switching and contention for shared resources. One important shared resource is main memory, and excessive use of this resource by applications and internal processes eventually leads to a decrease in cache efficiency that eventually stalls the instruction pipeline. Our results support this theory; specifically, we have observed that excessive context switching in active applications increases the effective memory access time and wastes precious CPU cycles, thus adding additional delay to the execution of load, store, and other instructions. Because the operating system (OS) kernel accesses memory to send network packets, the delay signature is induced into network traffic in situations where user-level utilization is high. We demonstrate this theory in two case studies: (1) resource discovery in cluster grids and (2) network-based detection of bitcoin mining on compromised nodes.

We present the details of a novel method for passive resource discovery in cluster grid environments, where resources constantly utilize internode communication. Our method offers the ability to nonintrusively identify resources that have available CPU cycles; this is critical for lowering queue wait times in large cluster grid networks. The benefits include: 1) low message complexity, which facilitates low latency in distributed networks, 2) scalability, which provides support for very large networks, and 3) low maintainability, since no additional software is needed on compute resources. Using a 50-node (multicore) test bed (DETERlab), we demonstrate the feasibility of our method with experiments utilizing TCP, UDP, and ICMP network traffic. We use a simple but powerful technique that monitors the frequency of network packets emitted from the Network Interface Card (NIC) of local resources. We observed the correlation between CPU load and the timely response of network traffic. A highly utilized CPU will have numerous, active processes which require context switching. The latency associated with numerous context switches manifests as a delay signature within the packet transmission process. Our method detects that delay signature to determine the utilization of network resources. Results show that our method can consistently and accurately identify nodes with available CPU cycles (<;70 percent CPU utilization) through analysis of existing network traffic, including network traffic that has passed through a switch (noncongested). Also, in situations where there is no existing network traffic for nodes, ICMP ping replies can be used to ascertain this resource information.

Resource discovery is an important problem in distributed computing, because the throughput of the system is directly linked to its ability to quickly locate available resources. Current solutions are undesirable for discovering resources in large computational clusters because they are intrusive, chatty (i.e., have per-node overhead), or maintenance-intensive. In this paper, we present a novel method that offers the ability to non-intrusively identify resources that have available memory; this is critical for memory-intensive cluster applications such as weather forecasting and computational chemistry. The prime benefits are fourfold: (1) low message complexity, (2) scalability, (3) load balancing, and (4) low maintainability. We demonstrate the feasibility of our method with experiments using a 50-node test-bed (DETERlab). Our technique allows us to establish a correlation between memory load and the timely response of network traffic from a node. Results show that our method can accurately (92%-100%) identify nodes with available memory through analysis of existing network traffic, including network traffic that has passed through a switch (non-congested).

In this paper we propose a passive approach to using network traffic to discover the availability of resources in local distributed networks (e.g., cluster grids, campus desktop grids, etc.). To our knowledge, this is the first approach of its kind. The ability to quickly identify resource availability is critical because the presence of available resources directly affects the job execution time of a distributed environment. The proposed method creates a delay sensitive profile generated by the analysis of monitored network traffic, which emulates high performance UDP based grid services such as file transfer applications (FOBS, Tsunami, UDT, SABUL, etc.), message passing platforms (MPICHG2/Score, etc.), and others. An energy value is derived from the delay sensitive profile, which represents the state (over-utilized CPU or under-utilized CPU) of the resource of interest. Then a simple threshold (derived from initial calibrations on the over-utilized resources.) is applied to the energy value to identify the state of the resource. This method could be used to enhance existing resource discovery algorithms used in local distributed networks because this approach is capable of passively determining a major dynamic resource attribute - CPU utilization. The main benefits are the reduction in the necessary complexity associated with the use of non-passive algorithms (e.g., flooding algorithm, name-dropper algorithm, distinctive awareness algorithm, etc.) and the reduction in the extra network traffic that results from the continual need to determine the availability of dynamic resources. Since this method is passive in nature, there is no need to query potential resources directly to determine their availability to complete distributed computing related jobs. Results suggest that once the CPU utilization approaches 70% (unavailable) the network traffic produced by that node exhibits different behavior than when the CPU utilization is less than 70% (available).

Unauthorized or rogue access points (APs) produce security vulnerabilities in enterprise/campus networks by circumventing inherent security mechanisms. We propose to use the round trip time (RTT) of network traffic to distinguish between wired and wireless nodes. This information coupled with a standard wireless AP authorization policy allows the differentiation (at a central location) between wired nodes, authorized APs, and rogue APs. We show that the lower capacity and the higher variability in a wireless network can be used to effectively distinguish between wired and wireless nodes. Further, this detection is not dependant upon the wireless technology (802.11a, 802.11b, or 802.11g), is scalable, does not contain the inefficiencies of current solutions, remains valid as the capacity of wired and wireless links increase, and is independent of the signal range of the rogue APs.