Skip to main content

2018 | OriginalPaper | Buchkapitel

3. Argumentation-Based Cyber Attribution: The DeLP3E Model

verfasst von : Eric Nunes, Paulo Shakarian, Gerardo I. Simari, Andrew Ruef

Erschienen in: Artificial Intelligence Tools for Cyber Attribution

Verlag: Springer International Publishing

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

In cyber attribution, knowledge bases consisting of all the available information for a specific domain, along with the current state of affairs, will typically contain contradictory data coming from different sources, as well as data with varying degrees of uncertainty attached. In this chapter, we propose a probabilistic structured argumentation framework that arises from the extension of Presumptive Defeasible Logic Programming (PreDeLP) with probabilistic models, and argue that this formalism is especially suitable for handling such contradictory and uncertain data–hence the framework would be well-suited for cyber attribution. We conclude with the demonstration—via a case study—of how our framework can be used to address the attribution problem in cybersecurity.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Fußnoten
1
The causality is a little more complicated than this sentence suggests. The cyber attribution problem was indeed the original motivation for the development of DeLP3E, and elements of the example evolved along with the formalism.
 
2
In the sense of providing reasons for and against a position.
 
3
Langner was later vindicated by the discovery of an older sample, Stuxnet 0.5, which generated the data block [3].
 
Literatur
1.
Zurück zum Zitat C. E. Alchourrón, P. Gärdenfors, and D. Makinson. On the logic of theory change: Partial meet contraction and revision functions. J. Sym. Log., 50(2):510–530, 1985.MathSciNetCrossRefMATH C. E. Alchourrón, P. Gärdenfors, and D. Makinson. On the logic of theory change: Partial meet contraction and revision functions. J. Sym. Log., 50(2):510–530, 1985.MathSciNetCrossRefMATH
2.
Zurück zum Zitat C. Altheide. Digital Forensics with Open Source Tools. Syngress, 2011.CrossRef C. Altheide. Digital Forensics with Open Source Tools. Syngress, 2011.CrossRef
3.
Zurück zum Zitat S. Corp. Stuxnet 0.5: Disrupting Uranium Processing at Natanz. Symantec Connect, Feb. 2013. S. Corp. Stuxnet 0.5: Disrupting Uranium Processing at Natanz. Symantec Connect, Feb. 2013.
4.
Zurück zum Zitat P. M. Dung. On the acceptability of arguments and its fundamental role in nonmonotonic reasoning, logic programming and n-person games. Artificial Intelligence, 77:pp. 321–357, 1995.MathSciNetCrossRefMATH P. M. Dung. On the acceptability of arguments and its fundamental role in nonmonotonic reasoning, logic programming and n-person games. Artificial Intelligence, 77:pp. 321–357, 1995.MathSciNetCrossRefMATH
5.
Zurück zum Zitat N. Falliere, L. O. Murchu, and E. Chien. W32.Stuxnet Dossier Version 1.4. Symantec Corporation, Feb. 2011. N. Falliere, L. O. Murchu, and E. Chien. W32.Stuxnet Dossier Version 1.4. Symantec Corporation, Feb. 2011.
6.
Zurück zum Zitat A. J. García and G. R. Simari. Defeasible logic programming: An argumentative approach. Theory and Practice of Logic Programming, 4(1-2):95–138, 2004.MathSciNetCrossRefMATH A. J. García and G. R. Simari. Defeasible logic programming: An argumentative approach. Theory and Practice of Logic Programming, 4(1-2):95–138, 2004.MathSciNetCrossRefMATH
7.
Zurück zum Zitat P. Gardenfors. Knowledge in flux: modeling the dynamics of epistemic states. MIT Press, Cambridge, Mass., 1988.MATH P. Gardenfors. Knowledge in flux: modeling the dynamics of epistemic states. MIT Press, Cambridge, Mass., 1988.MATH
8.
Zurück zum Zitat P. Gärdenfors. Belief revision, volume 29. Cambridge University Press, 2003. P. Gärdenfors. Belief revision, volume 29. Cambridge University Press, 2003.
9.
Zurück zum Zitat R. J. Heuer. Psychology of Intelligence Analysis. Center for the Study of Intelligence, 1999. R. J. Heuer. Psychology of Intelligence Analysis. Center for the Study of Intelligence, 1999.
10.
Zurück zum Zitat S. Khuller, M. V. Martinez, D. S. Nau, A. Sliva, G. I. Simari, and V. S. Subrahmanian. Computing most probable worlds of action probabilistic logic programs: scalable estimation for 1030,000 worlds. Annals of Mathematics and Artificial Intelligence, 51(2-4):295–331, 2007.MathSciNetCrossRefMATH S. Khuller, M. V. Martinez, D. S. Nau, A. Sliva, G. I. Simari, and V. S. Subrahmanian. Computing most probable worlds of action probabilistic logic programs: scalable estimation for 1030,000 worlds. Annals of Mathematics and Artificial Intelligence, 51(2-4):295–331, 2007.MathSciNetCrossRefMATH
11.
Zurück zum Zitat R. Langner. Matching Langner Stuxnet analysis and Symantic dossier update. Langner Communications GmbH, Feb. 2011. R. Langner. Matching Langner Stuxnet analysis and Symantic dossier update. Langner Communications GmbH, Feb. 2011.
12.
Zurück zum Zitat J. W. Lloyd. Foundations of Logic Programming, 2nd Edition. Springer, 1987. J. W. Lloyd. Foundations of Logic Programming, 2nd Edition. Springer, 1987.
13.
Zurück zum Zitat M. V. Martinez, A. J. García, and G. R. Simari. On the use of presumptions in structured defeasible reasoning. In Proceedings of the International Conference on Computational Models of Argument (COMMA), pages 185–196, 2012. M. V. Martinez, A. J. García, and G. R. Simari. On the use of presumptions in structured defeasible reasoning. In Proceedings of the International Conference on Computational Models of Argument (COMMA), pages 185–196, 2012.
15.
Zurück zum Zitat I. Rahwan and G. R. Simari. Argumentation in Artificial Intelligence. Springer, 2009. I. Rahwan and G. R. Simari. Argumentation in Artificial Intelligence. Springer, 2009.
16.
Zurück zum Zitat L. Riley, K. Atkinson, T. R. Payne, and E. Black. An implemented dialogue system for inquiry and persuasion. In Proceedings of the International Workshop on Theory and Applications of Formal Argumentation (TAFA), pages 67–84. Springer, 2011. L. Riley, K. Atkinson, T. R. Payne, and E. Black. An implemented dialogue system for inquiry and persuasion. In Proceedings of the International Workshop on Theory and Applications of Formal Argumentation (TAFA), pages 67–84. Springer, 2011.
17.
Zurück zum Zitat Shadows in the Cloud: Investigating Cyber Espionage 2.0. Technical report, Information Warfare Monitor and Shadowserver Foundation, April 2010. Shadows in the Cloud: Investigating Cyber Espionage 2.0. Technical report, Information Warfare Monitor and Shadowserver Foundation, April 2010.
18.
Zurück zum Zitat G. Shafer et al. A mathematical theory of evidence, volume 1. Princeton university press Princeton, 1976. G. Shafer et al. A mathematical theory of evidence, volume 1. Princeton university press Princeton, 1976.
19.
Zurück zum Zitat P. Shakarian, J. Shakarian, and A. Ruef. Introduction to Cyber-Warfare: A Multidisciplinary Approach. Syngress, 2013. P. Shakarian, J. Shakarian, and A. Ruef. Introduction to Cyber-Warfare: A Multidisciplinary Approach. Syngress, 2013.
20.
Zurück zum Zitat P. Shakarian, G. I. Simari, G. Moores, D. Paulo, S. Parsons, M. A. Falappa, and A. Aleali. Belief revision in structured probabilistic argumentation. Annals of Mathematics and Artificial Intelligence, 78(3-4):259–301, 2016.MathSciNetCrossRefMATH P. Shakarian, G. I. Simari, G. Moores, D. Paulo, S. Parsons, M. A. Falappa, and A. Aleali. Belief revision in structured probabilistic argumentation. Annals of Mathematics and Artificial Intelligence, 78(3-4):259–301, 2016.MathSciNetCrossRefMATH
21.
Zurück zum Zitat G. R. Simari and R. P. Loui. A mathematical treatment of defeasible reasoning and its implementation. Artificial Intelligence, 53(2-3):125–157, 1992.MathSciNetCrossRefMATH G. R. Simari and R. P. Loui. A mathematical treatment of defeasible reasoning and its implementation. Artificial Intelligence, 53(2-3):125–157, 1992.MathSciNetCrossRefMATH
22.
Zurück zum Zitat G. I. Simari, M. V. Martinez, A. Sliva, and V. S. Subrahmanian. Focused most probable world computations in probabilistic logic programs. Annals of Mathematics and Artificial Intelligence, 64(2-3):113–143, 2012.MathSciNetCrossRefMATH G. I. Simari, M. V. Martinez, A. Sliva, and V. S. Subrahmanian. Focused most probable world computations in probabilistic logic programs. Annals of Mathematics and Artificial Intelligence, 64(2-3):113–143, 2012.MathSciNetCrossRefMATH
23.
Zurück zum Zitat L. Spitzner. Honeypots: Catching the Insider Threat. In Proceedings of the Computer Security Applications Conference, pages 170–179. IEEE Computer Society, 2003. L. Spitzner. Honeypots: Catching the Insider Threat. In Proceedings of the Computer Security Applications Conference, pages 170–179. IEEE Computer Society, 2003.
24.
Zurück zum Zitat F. Stolzenburg, A. García, C. I. Chesñevar, and G. R. Simari. Computing Generalized Specificity. Journal of Non-Classical Logics, 13(1):87–113, 2003.CrossRefMATH F. Stolzenburg, A. García, C. I. Chesñevar, and G. R. Simari. Computing Generalized Specificity. Journal of Non-Classical Logics, 13(1):87–113, 2003.CrossRefMATH
25.
Zurück zum Zitat O. Thonnard, W. Mees, and M. Dacier. On a multicriteria clustering approach for attack attribution. SIGKDD Explorations, 12(1):11–20, 2010.CrossRef O. Thonnard, W. Mees, and M. Dacier. On a multicriteria clustering approach for attack attribution. SIGKDD Explorations, 12(1):11–20, 2010.CrossRef
Metadaten
Titel
Argumentation-Based Cyber Attribution: The DeLP3E Model
verfasst von
Eric Nunes
Paulo Shakarian
Gerardo I. Simari
Andrew Ruef
Copyright-Jahr
2018
DOI
https://doi.org/10.1007/978-3-319-73788-1_3