The domain name system plays a vital role in the dependability and security of modern network. Unfortunately, it has also been widely misused for nefarious activities. Recently, attackers have turned their attention to the use of algorithmically generated domain names (AGDs) in an effort to circumvent network defenses. However, because such domain names are increasingly being used in benign applications, this transition has significant implications for techniques that classify AGDs based solely on the format of a domain name. To highlight the challenges they face, we examine contemporary approaches and demonstrate their limitations. We address these shortcomings by proposing an online form of sequential hypothesis testing that classifies clients based solely on the non-existent (NX) responses they elicit. Our evaluations on real-world data show that we outperform existing approaches, and for the vast majority of cases, we detect malware before they are able to successfully rendezvous with their command and control centers.

As researchers with scientific training in fields that depend on experimental results to make progress, we have long been puzzled by the resistance of the experimental computer science community in general, and computer security research in particular, to the use of the methods of experimentation and reporting that are commonplace in most scientific undertakings. To bring our concerns to a broader audience, we proposed a discussion topic for NSPW 2010 that covers the history and practicality of experimental information security with an emphasis on exposing the pros and cons of the application of rigorous scientific experimental methodology in our work. We focused on discussion points that explore the challenges we face as scientists, and we tried to identify a set of concrete steps to resolve the apparent conflict between desire and practice. We hoped that the application of these steps to the papers accepted at NSPW could be an early opportunity to begin a journey toward putting more science into cyber science. The discussion, as expected, was wide ranging, interesting, and often frustrating. This paper is a slight modification of the discussion proposal that was accepted by NSPW with the addition of a brief summary of the discussion.

In this paper, we explore the effectiveness of using graphical methods for isolating the differences between common application protocols---both in their transient and steady-state behavior. Specifically, we take advantage of the observation that many Internet application protocols proscribe a very specific series of client/server interactions that are clearly visible in the sizes and timing of packets produced at the network layer and below. We show how so-called "visual motifs" built on these features can be used to assist a human operator to recognize application protocols in unidentified traffic. From a practical point of view, visual traffic classification can be used, for example, for anomaly detection to verify that all traffic to a web server on TCP port 80 does indeed exhibit the characteristic behavior patterns of HTTP, or for misuse detection to find unauthorized servers or to identify traffic generated by prohibited applications. We present our technique for building a classifier based on the notion of visual motifs and report on our experience using this technique to automatically classify on-the-wire behavioral patterns from network flow data collected from a campus network. Specifically, we analyze over 1 billion flows corresponding to over 5 million sessions on nearly 200 distinct ports and show that our approach achieves high recall and precision.

Many network visualizations make the assumption that an administrator has previously determined the subset of data that should be visualized. Yet the problem remains that if the visualization provides no insight into the network events that warrant further consideration, then the administrator must go back to the data to determine what should be visualized next. This is a critical issue given the amount of network data under consideration, only a small portion of which can be examined at any one time. In this paper we present a visualization that provides context for network visualizations by providing a high-level view of network events. Our visualization not only provides a starting point for network visualization, but also reduces the cognitive burden of the analyst by providing a visual paradigm for both the filtering of network data and the selection of network data to drill into and visualize with alternative representations. We demonstrate, through the use of a case study, that our visualization can provide motivation for further investigation into anomalous network activity.

For over twenty years, software diversity has been touted in some circles as an effective and cost effective way to improve system reliability. Based on well established practice in the replicated hardware arena, the notion is that, if replica failures are independent, exponential gains in reliability can be obtained for linear increments in cost. Unfortunately in the software case, the "if" is, in general, not true and the gains that can be realized are far from exponential. The kinds of hardware failures against which replication works are distributed independently randomly in the time domain. Software failures are time invariant and distributed in the data domain (with uncertain distributions) so that identical replicas will all fail on the same inputs. Thus, the holy grail of software fault tolerance has been to introduce diversity in such a way that failures are distributed independently in the data domain. These have been largely unsuccessful.

Locality as a unifying concept for understanding the normal behavior of benign users of computer systems is suggested as a unifying paradigm that will support the detection of malicious anomalous behaviors. The paper notes that locality appears in many dimensions and applies to such diverse mechanisms as the working set of IP addresses contacted during a web browsing session, the set of email addresses with which one customarily corresponds, the way in which pages are fetched from a web site. In every case intrusive behaviors that violate locality are known to exist and in some cases, the violation is necessary for the intrusive behavior to achieve its goal. If this observation holds up under further investigation, we will have a powerful way of thinking about security and intrusive activity.

Previously (J. McHugh, 1984), we outlined an information flow tool for the Gypsy language (D. Good et al., 1978) that could be used to support covert channel analysis. The proposed tool offered substantial advantages over existing tools in flexibility and promised to be useful for a variety of analyses. Two versions of the tool were subsequently built and used for a variety of MLS and other projects. The paper draws on the original, adding motivational and explanatory material and adds descriptions of the subsequent tools. It also illustrates a novel use of one of the tools in developing an architecture for a MLS windowing system.

We have conducted an empirical study of a number of computer security exploits and determined that the rates at which incidents involving the exploit are reported to CERT can be modeled using a common mathematical framework. Data associated with three significant exploits involving vulnerabilities in phf, imap, and bind can all be modeled using the formula C=I+S/spl times//spl radic/M where C is the cumulative count of reported incidents, M is the time since the start of the exploit cycle, and I and S are the regression coefficients determined by analysis of the incident report data. Further analysis of two additional exploits involving vulnerabilities in mountd and statd confirm the model. We believe that the models will aid in predicting the severity of subsequent vulnerability exploitations, based on the rate of early incident reports.

In 1998 and again in 1999, the Lincoln Laboratory of MIT conducted a comparative evaluation of intrusion detection systems (IDSs) developed under DARPA funding. While this evaluation represents a significant and monumental undertaking, there are a number of issues associated with its design and execution that remain unsettled. Some methodologies used in the evaluation are questionable and may have biased its results. One problem is that the evaluators have published relatively little concerning some of the more critical aspects of their work, such as validation of their test data. The appropriateness of the evaluation techniques used needs further investigation. The purpose of this article is to attempt to identify the shortcomings of the Lincoln Lab effort in the hope that future efforts of this kind will be placed on a sounder footing. Some of the problems that the article points out might well be resolved if the evaluators were to publish a detailed description of their procedures and the rationale that led to their adoption, but other problems would clearly remain./par>

The secure management of groups containing thousands or possibly hundreds of thousands of members with very high rates of membership turnover is claimed to be a critical need for high confidence networking. Among the needs mentioned are the ability to ensure that former group members can no longer obtain access to group materials and to prevent new members from accessing material distributed to the group prior to their entry. Suggestions made in this area exhibit a strong bias towards cryptographic techniques and key management to realize these goals, pointing out the weaknesses in currently available techniques. The purpose of the present paper is to examine some of the assumptions that appear to be implicit in these suggestions. An examination of group function and behavior might indicate alternative ways to manage large groups securely. We note that the call for ever more complex technological solutions to problems that may be sociological in nature continues a disturbing (and largely unsuccessful) trend that began in the pre-TCSEC days and that continues into the present.

This paper describes the architecture of a prototype multilevel secure windowing system based on the X Window System. The prototype, known as TX, is designed to meet the class B3 architectural requirements of the Trusted Computer System Evaluation Cr

The results of an experiment that shows that it is very simple to contaminate digital images with information that can later be extracted are presented. This contamination cannot be detected when the image is displayed on a good quality graphics workstation. Based on these results, it is recommended that image downgrading based on visual display of the image to be downgraded not be performed if there is any threat of image contamination by Trojan horse programs. Potential Trojan horse programs may include untrusted image processing software.>

The early issues, obstacles, and ultimate achievements of Phase II of the US DARPA Advanced Computing Systems project to develop a proof-of-concept prototype for a B3 X-Window system on a TMach base are described. The present work defines initial project goals, presents an overview of X, and describes system objectives. The major implications of meeting the B3 trust criteria and the constraints of building the Trusted X prototype on the TMach system (itself a prototype) are described. The reader is led through the process of Trusted X evolution from an initial architecture requiring a large and complex TCB to an architecture based on task polyinstantiation greatly simplifying the TCB.>

Multilevel secure windowing systems are a key technology for the 1990s. The authors have spent 20 months designing and implementing a prototype of a multilevel secure X Window System as a proof of concept vehicle for their software engineering process model for the development of trusted systems. The prototype is targeted to B3 evaluation criteria. In the early stages many doubted that B3 was achievable for a windowing system (especially X); the prototype demonstrates that B3 is achievable. The paper describes the goals, the architecture of the system, and some of the trade-offs made to achieve the goals. It also contrasts the work with existing compartmented mode workstations (CMW) windowing systems.>

This paper presents the initial results of a DARPA-funded research effort to define a development paradigm for high-performance trusted systems in Ada. The paradigm is aimed at improving the construction process and the future products of Ada systems that require both broad trust and high performance. The need for a process model and the notions of trust and assurance are reviewed. The foundation for the process model and its elements are presented. The process model is contrasted with traditional development approaches. The combination of a risk driven approach with the integration of trust and performance engineering into a unified whole appears to offer substantial advantages to system builders.>

One criterion for "Beyond Al" certification according to the DoD Trusted Computer Systems Evaluation Criteria will be code-level verification. We argue that, while verification at the actual code level may be infeasible for large secure systems, it is possible to push the verification to a low level of abstraction and then map the specification in an intuitive manner to the source code. Providing a suitable mapping requires adhering to a strict discipline on both the specification and code sides. We discuss the issues involved in this problem, particularizing the discussion to a mapping from Gypsy specifications to C code.

This paper examines the application of two covert channel analysis techniques to a high level design for a real system, the Honeywell Secure Ada® Target (SAT). The techniques used were a version of the noninterference model of multilevel security due to Goguen and Meseguer and the shared resource matrix method of Kemmerer. Both techniques were applied to the Gypsy Abstract Model of the SAT. The paper discusses the application of the techniques and the nature of the covert channels discovered. The relative strengths and weaknesses of the two methods are discussed and criteria for an ideal covert channel tool are developed.

This paper examines the application of two covert channel analysis techniques to a high level design for a real system the Honeywell Secure Ada Target (SAT). The techniques used were a version of the non-interference model of multilevel security due to Goguen and Meseguer and the shared resource matrix method of Kemmerer. Both techniques were applied to the Gypsy abstract model of the SAT. The paper discusses the application of the techniques and the nature of the covert channels discovered. The relative strengths and weaknesses of the two methods are discussed and criteria for an ideal covert channel tool are developed.

This paper describes a Gypsy[l] realization of a formal security policy model and top level specification for a secure, multi-level loud area network (LAN). The network, which is being developed by the Verdix Corporation of Chantilly, Virginia, is one of the fmt network products to be accepted for developmental evaluation by the Computer Security Center leading to, we hope, an eventual certification at the A-1 level. Because network criteria are still undergoing development, the LAN will be evaluated under the TCSEC [2] criteria for multi-level secure computer systems. The remainder of the paper briefly describes the LAN itself, the policy model and its Gypsy representation,and FTLS. This is followed by a discussion of related issues such as covert channel analysis. The conclusions will cover both the applicability of the TCSEC criteria to network products such as this and the use of such products as building blocks for distributed semre systems.

The Gypsy language is seeing increasing use as a tool for designing, specifying, and sometimes implementing computer systems intended for certification at the A1 level by the Department of Defense Computer Security Center. One of the criteria for A1 certification is a formal proof that the information flows within the design conform to a policy defined by formal security model. Despite the fact that it is possible to state such models in Gypsy and to prove some properties of programs with respect to a model, a flow analysis tool within the Gypsy environment would appear to be useful. The Gypsy Verification Environment, GVE, contains the basis for such tool in the form of a flow analyzer used to detect unused variables during optimization. In the discussion below, we will describe a simple information flow analyzer based upon this analysis.