Skip to main content

2014 | OriginalPaper | Buchkapitel

3. Automated Cyber Situation Awareness Tools and Models for Improving Analyst Performance

verfasst von : Massimiliano Albanese, Hasan Cam, Sushil Jajodia

Erschienen in: Cybersecurity Systems for Human Cognition Augmentation

Verlag: Springer International Publishing

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

An ever increasing number of critical missions rely today on complex Information Technology infrastructures, making such missions vulnerable to a wide range of potentially devastating cyber-attacks. Attackers can exploit network configurations and vulnerabilities to incrementally penetrate a network and compromise critical systems, thus rendering security monitoring and intrusion detection much more challenging. It is also evident from the ever growing number of high-profile cyber-attacks reported in the news that not only are cyber-attacks growing in sophistication but also in numbers. For these reasons, cyber-security analysts need to continuously monitor large amounts of alerts and data from a multitude of sensors in order to detect attacks in a timely manner and mitigate their impact. However—given the inherent complexity of the problem—manual analysis is labor-intensive and error-prone, and distracts the analyst from getting the “big picture” of the cyber situation.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
1.
Zurück zum Zitat M. Albanese, S. Jajodia, and S. Noel. “Time-Efficient and Cost-Effective Network Hardening Using Attack Graphs”. In Proceedings of the 42nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2012), Boston, Massachusetts, USA, June 25-28, 2012. M. Albanese, S. Jajodia, and S. Noel. “Time-Efficient and Cost-Effective Network Hardening Using Attack Graphs”. In Proceedings of the 42nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2012), Boston, Massachusetts, USA, June 25-28, 2012.
2.
Zurück zum Zitat M. Albanese, S. Jajodia, A. Pugliese, and V. S. Subrahmanian. “Scalable Analysis of Attack Scenarios”. In Proceedings of the 16th European Symposium on Research in Computer Security (ESORICS 2011), pages 416-433, Leuven, Belgium, September 12-14, 2011. M. Albanese, S. Jajodia, A. Pugliese, and V. S. Subrahmanian. “Scalable Analysis of Attack Scenarios”. In Proceedings of the 16th European Symposium on Research in Computer Security (ESORICS 2011), pages 416-433, Leuven, Belgium, September 12-14, 2011.
3.
Zurück zum Zitat M. Albanese, A. Pugliese, and V. S. Subrahmanian. “Fast Activity Detection: Indexing for Temporal Stochastic Automaton based Activity Models”. IEEE Transactions on Knowledge and Data Engineering, 2013. M. Albanese, A. Pugliese, and V. S. Subrahmanian. “Fast Activity Detection: Indexing for Temporal Stochastic Automaton based Activity Models”. IEEE Transactions on Knowledge and Data Engineering, 2013.
4.
Zurück zum Zitat “Cyber Situational Awareness: Issues and Research”. S. Jajodia, P. Liu, V. Swarup, and C. Wang (Eds.), Vol. 46 of Advances in Information Security, Springer, 2010. “Cyber Situational Awareness: Issues and Research”. S. Jajodia, P. Liu, V. Swarup, and C. Wang (Eds.), Vol. 46 of Advances in Information Security, Springer, 2010.
5.
Zurück zum Zitat H. Gardner. “The Mind’s New Science: A History of the Cognitive Revolution”, Basic Books, 1987. H. Gardner. “The Mind’s New Science: A History of the Cognitive Revolution”, Basic Books, 1987.
6.
Zurück zum Zitat P. Johnson-Laird, “How We Reason”, Oxford University Press, 2006. P. Johnson-Laird, “How We Reason”, Oxford University Press, 2006.
7.
Zurück zum Zitat M. Endsley. “Toward a theory of situation awareness in dynamic systems”. In Human Factors Journal, volume 37(1), pages 32–64, March 1995. M. Endsley. “Toward a theory of situation awareness in dynamic systems”. In Human Factors Journal, volume 37(1), pages 32–64, March 1995.
8.
Zurück zum Zitat D. S. Alberts, J. J. Garstka, R. E. Hayes, and D. A. Signori. “Understanding information age warfare”. In DoD Command and Control Research Program Publication Series, 2001. D. S. Alberts, J. J. Garstka, R. E. Hayes, and D. A. Signori. “Understanding information age warfare”. In DoD Command and Control Research Program Publication Series, 2001.
9.
Zurück zum Zitat P. Ammann, D. Wijesekera, and S. Kaushik, “Scalable, graph-based network vulnerability analysis,” in Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS 2002), pp. 217–224, Washington, DC, USA, November 2002. P. Ammann, D. Wijesekera, and S. Kaushik, “Scalable, graph-based network vulnerability analysis,” in Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS 2002), pp. 217–224, Washington, DC, USA, November 2002.
10.
Zurück zum Zitat C. Phillips and L. P. Swiler, “A graph-based system for network-vulnerability analysis,” in Proceedings of the New Security Paradigms Workshop (NSPW 1998), pp. 71–79, Charlottesville, VA, USA, September 1998. C. Phillips and L. P. Swiler, “A graph-based system for network-vulnerability analysis,” in Proceedings of the New Security Paradigms Workshop (NSPW 1998), pp. 71–79, Charlottesville, VA, USA, September 1998.
11.
Zurück zum Zitat S. Jajodia, S. Noel, P. Kalapa, M. Albanese, and J. Williams, “Cauldron: Mission-centric cyber situational awareness with defense in depth,” in Proceedings of the Military Communications Conference (MILCOM 2011), Baltimore, MD, USA, November 2011. S. Jajodia, S. Noel, P. Kalapa, M. Albanese, and J. Williams, “Cauldron: Mission-centric cyber situational awareness with defense in depth,” in Proceedings of the Military Communications Conference (MILCOM 2011), Baltimore, MD, USA, November 2011.
12.
Zurück zum Zitat L. Wang, A. Liu, and S. Jajodia, “Using attack graphs for correlating, hypothesizing, and predicting intrusion alerts,” Computer Communications, vol. 29, no. 15, pp. 2917–2933, September 2006. L. Wang, A. Liu, and S. Jajodia, “Using attack graphs for correlating, hypothesizing, and predicting intrusion alerts,” Computer Communications, vol. 29, no. 15, pp. 2917–2933, September 2006.
13.
Zurück zum Zitat M. Albanese, S. Jajodia, A. Singhal, and L. Wang. “An Efficient Approach to Assessing the Risk of Zero-Day Vulnerabilities”. In Proceedings of the 10th International Conference on Security and Cryptography (SECRYPT 2013), Reykjavìk, Iceland, July 29-31, 2013. M. Albanese, S. Jajodia, A. Singhal, and L. Wang. “An Efficient Approach to Assessing the Risk of Zero-Day Vulnerabilities”. In Proceedings of the 10th International Conference on Security and Cryptography (SECRYPT 2013), Reykjavìk, Iceland, July 29-31, 2013.
14.
Zurück zum Zitat H. Cam, P. Mouallem, Y. Mo, B. Sinopoli, and B. Nkrumah, “Modeling Impact of Attacks, Recovery, and Attackability Conditions for Situational Awareness”, Proc. of 2014 IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA), March 3-6, 2014, San Antonio, TX, USA. H. Cam, P. Mouallem, Y. Mo, B. Sinopoli, and B. Nkrumah, “Modeling Impact of Attacks, Recovery, and Attackability Conditions for Situational Awareness”, Proc. of 2014 IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA), March 3-6, 2014, San Antonio, TX, USA.
15.
Zurück zum Zitat P. Xie, J.H. Li, X. Ou, P. Liu, and R. Levy, “Using Bayesian Networks for Cyber Security Analysis,” Proc. of 2010 IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2010. P. Xie, J.H. Li, X. Ou, P. Liu, and R. Levy, “Using Bayesian Networks for Cyber Security Analysis,” Proc. of 2010 IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2010.
Metadaten
Titel
Automated Cyber Situation Awareness Tools and Models for Improving Analyst Performance
verfasst von
Massimiliano Albanese
Hasan Cam
Sushil Jajodia
Copyright-Jahr
2014
DOI
https://doi.org/10.1007/978-3-319-10374-7_3