Detecting Deception in the Context of Web 2.0. Annarita Giani , - - PowerPoint PPT Presentation

▶
detecting deception in the context of web 2 0
SMART_READER_LITE
LIVE PREVIEW

Detecting Deception in the Context of Web 2.0. Annarita Giani , - - PowerPoint PPT Presentation

Mar 20, 2023 34 likes •339 views

Detecting Deception in the Context of Web 2.0. Annarita Giani , EECS, University of California, Berkeley, CA Paul Thompson, CS Dept. Dartmouth College, Hanover, NH W2SP2007 Oakland, CA May 24, 2007 Outline 1.Motivation and Terminology

slide-1
SLIDE 1

W2SP2007 – Oakland, CA – May 24, 2007

Detecting Deception in the Context of Web 2.0.

Annarita Giani,

EECS, University of California, Berkeley, CA

Paul Thompson,

CS Dept. Dartmouth College, Hanover, NH

slide-2
SLIDE 2

2

W2SP2007 – Oakland, CA – May 24, 2007

Outline

1.Motivation and Terminology 2.Process Query System (PQS) Approach 3.Detection of a complex attack 4.Conclusion and Acknowledgments

slide-3
SLIDE 3

3

W2SP2007 – Oakland, CA – May 24, 2007

Cognitive Hacking

The user's attention is focused on the channel. The attacker exploits this fact and uses malicious information in the channel to mislead her.

Misleading information from a web site Misleading information from a web site 2 1 Victim: Acts on the information from the web site 3 Attacker: Obtains advantages from user actions Attacker: Makes a fake web site 4

slide-4
SLIDE 4

4

W2SP2007 – Oakland, CA – May 24, 2007

MISINFORMATION MISINFORMATION – – Lebed Lebed case case

The law ???

Jonathan Lebed.

He spread fake rumors about stocks

.

Investors driven to buy shares of that stock inflating its price The SEC wanted to prosecuted him for stock fraud. Was allowed to keep $500,000 from his “illegal” stock proceeds.

"Subj: THE MOST UNDERVALUED STOCK EVER "Date: 2/03/00 3:43pm Pacific Standard Time "From: LebedTG1 "FTEC is starting to break out! Next week, this thing will EXPLODE. . . . "Currently FTEC is trading for just $2 1/2! I am expecting to see FTEC at $20 VERY SOON. "Let me explain why. . . . "The FTEC offices are extremely busy. . . . I am hearing that a number of HUGE deals are being worked on. Once we get some news from FTEC and the word gets out about the company . . . it will take-off to MUCH HIGHER LEVELS! "I see little risk when purchasing FTEC at these DIRT-CHEAP PRICES. FTEC is making TREMENDOUS PROFITS and is trading UNDER BOOK VALUE!!!"

slide-5
SLIDE 5

5

W2SP2007 – Oakland, CA – May 24, 2007

Covert Channels

The user's attention is unaware of the channel. The attacker uses a medium not perceived as a communication channel to transfer information.

User: does not see inter- packet delay as a communication channel and does not notice any communication. User: does not see inter- packet delay as a communication channel and does not notice any communication. Attacker: Codes data into inter-packet delays, taking care to avoid drawing the attention of the user. data 1 2

slide-6
SLIDE 6

6

W2SP2007 – Oakland, CA – May 24, 2007

Phishing

The user's attention is attracted by the exploit. The information is used to lure the victim into using a new channel and then to create a false perception of reality with the goal of exploiting the user’s behavior.

Visit http://www.cit1zensbank.com

First name, Last name Account # SSN

Bogus web site First name, Last name Account Number SSN

1 3 2

Misleading email to get user attention Misleading email to get user attention Send a fake email

4

slide-7
SLIDE 7

7

W2SP2007 – Oakland, CA – May 24, 2007

Cognitive Channels

SERVER CLIENT USER

Network Channel

Cognitive Channel Focus of the current protection and detection approaches

A cognitive channel is a communication channel between the user and the technology being used. It conveys what the user sees, reads, hears, types, etc.

The cognitive channel is the weakest link in the whole framework. Little investigation has been done on detecting attacks on this channel.

slide-8
SLIDE 8

8

W2SP2007 – Oakland, CA – May 24, 2007

Cognitive Attacks

Cognitive attacks are computer attacks over a cognitive

  • channel. They exploit the attention of the user to manipulate

her perception of reality and/or gain advantages. Cognitive attacks are computer attacks over a cognitive

  • channel. They exploit the attention of the user to manipulate

her perception of reality and/or gain advantages.

COGNITIVE HACKING. The user’s attention is focused on the channel. The attacker exploits this fact and uses malicious information to mislead her. COVERT CHANNELS. The user is unaware of the channel. The attacker uses a medium not perceived as a communication channel to transfer information.

  • PHISHING. The user's attention is attracted by the exploit. The information is

used to lure the victim into using a new channel and then to create a false perception of reality with the goal of exploiting the user’s behavior.

Our definition is from an engineering point of view.

slide-9
SLIDE 9

9

W2SP2007 – Oakland, CA – May 24, 2007

The Need to Correlate Events

Large amount of sensors for network

monitoring

– Intrusion Detection Systems – Network traces – File Integrity Checkers

Large amount of Alerts

– Overloaded operators – Hard to make sense of alarms

Need a principled way of combining alerts

– Reduce false alarms – Discover multistage attacks

slide-10
SLIDE 10

10

W2SP2007 – Oakland, CA – May 24, 2007

Outline

1.Motivation and Terminology 2.Process Query System (PQS) Approach 3.Detection of a complex attack 4.Conclusion and Acknowledgments

slide-11
SLIDE 11

11

W2SP2007 – Oakland, CA – May 24, 2007

Process Query System

Observable events coming from sensors Observable events coming from sensors Models Models Tracking Algorithms Tracking Algorithms

PQS ENGINE

Hypothesis Hypothesis

slide-12
SLIDE 12

12

W2SP2007 – Oakland, CA – May 24, 2007

Framework for Process Detection

Multiple Processes λ1 = router failure λ2 = worm λ3 = scan Events …….

Time

An Environment

consists of that produce

Unlabelled Sensor Reports …….

Time

that are seen as

Hypothesis 1

Track 1 Track 2 Track 3

Hypothesis 2

that PQS resolves into that detect complex attacks and anticipate the next steps

129.170.46.3 is at high risk 129.170.46.33 is a stepping stone ......

that are used for control

1 2 3 4 5 6 Indictors and Warnings

Real World Process Detection (PQS)

Hypotheses

FORWARD PROBLEM

INVERSE PROBLEM

slide-13
SLIDE 13

13

W2SP2007 – Oakland, CA – May 24, 2007

Flow and Covert Channel Sensor Samba Snort Tripwire Snort IP Tables

Exfiltration

Data Access

Scanning Infection

PQS PQS PQS PQS PQS TIER 1 Models TIER 1 Observations TIER 1 Hypothesis TIER 2 Models TIER 2 Observations TIER 2 Hypothesis

Hierarchical PQS Architecture

Events Events Events Events More Complex Models

RESULTS

slide-14
SLIDE 14

14

W2SP2007 – Oakland, CA – May 24, 2007

Causal - next state depends only on the past Hidden – states are not directly observed Observable - observations conditioned on hidden state are independent of previous states

  • Example. Hidden Markov Model

N States M Observation symbols State transition Probability Matrix, A Observation Symbols Distribution, B Initial State Distribution π HDESM models are general

Hidden Discrete Event System Models

Dynamical systems with discrete state spaces that are:

slide-15
SLIDE 15

15

W2SP2007 – Oakland, CA – May 24, 2007

HDESM Process Detection Problem

Identifying and tracking several (casual discrete state) stochastic processes (HDESM’s) that are only partially

  • bservable.

Discrete Sources Separation: :Determine the “most likely” process-to-observation association Hidden State Estimation: Determine the “best” hidden states sequence of a particular process that accounts for a given sequence of observations. TWO MAIN CLASSES OF PROBLEMS

slide-16
SLIDE 16

16

W2SP2007 – Oakland, CA – May 24, 2007

Discrete Source Separation Problem

3 states + transition probabilities n observable events: a,b,c,d,e,… Pr( state | observable event ) given/known Observed event sequence: ….abcbbbaaaababbabcccbdddbebdbabcbabe…. Catalog of Processes Which combination of which process models “best” accounts for the observations?

HDESM Example (HMM):

Events not associated with a known process are “ANOMALIES”.

slide-17
SLIDE 17

17

W2SP2007 – Oakland, CA – May 24, 2007

An analogy....

What does hbeolnjouolor mean? Events are: h b e o l n j o u o l o r Models = French + English words (+ grammars!)

hbeolnjoulor = hello + bonjour

Intermediate hypotheses include tracks: ho + be

slide-18
SLIDE 18

18

W2SP2007 – Oakland, CA – May 24, 2007

Internet

DMZ WS

BRIDGE WinXP LINUX WWW Mail DIB:s BGP IPTables Snort Tripwire

Samhain

W

  • r

m E x f i l t r a t i

  • n

P h i s h i n g

PQS in Computer Security

5

8

7 12

1

2

PQS ENGINE

  • bservations
  • bservations
slide-19
SLIDE 19

19

W2SP2007 – Oakland, CA – May 24, 2007

Outline

1.Motivation and Terminology 2.Process Query System (PQS) Approach 3.Detection of a complex attack 4.Conclusion and Acknowledgments

slide-20
SLIDE 20

20

W2SP2007 – Oakland, CA – May 24, 2007

Complex Phishing Attack Steps

a t t a c k s t h e v i c t i m

100.10.20.9

Victim

100.20.3.127

Attacker

165.17.8.126

Web page, Madame X

uploads some code downloads some data

Stepping stone

51.251.22.183

records username and password … as usual browses the web and … …. visits a web page. inserts username and password. (the same used to access his machine) accesses user machine using username and password

1 5 4 3 2 6

slide-21
SLIDE 21

21

W2SP2007 – Oakland, CA – May 24, 2007

Complex Phishing Attack Observables

SOURCE

4 . A T T E M P T ( A T T A C K R E S P O N S E ) S N O R T P O T E N T I A L B A D T R A F F I C

100.10.20.9

Victim

100.20.3.127

Attacker

165.17.8.126

Web Server used- Madame X Attacker

  • 2. ATTEMPT SNORT

SSH (Policy Violation)

NON-STANDARD-PROTOCOL

  • 3. DATA UPLOAD

FLOW SENSOR

  • 5. DATA DOWNLOAD

FLOW SENSOR

  • 1. RECON

SNORT: KICKASS_PORN DRAGON: PORN HARDCORE

SOURCE DEST SOURCE SOURCE SOURCE DEST

DEST

DEST DEST

Stepping stone

51.251.22.183 Username password

Sept 29 11:17:09 Sept 29 11:24:07 S e p t 2 9 1 1 : 2 4 : 6 Sept 29 11:23:56 Sept 29 11:23:56

slide-22
SLIDE 22

22

W2SP2007 – Oakland, CA – May 24, 2007

Flow Sensor

  • Based on the libpcap interface for packet capturing.
  • Packets with the same source IP, destination IP, source port, destination

port, protocol are aggregated into the same flow.

We did not use Netflow only because it does not have all the fields that we need.

  • Timestamp of the last packet
  • # packets from Source to Destination
  • # packets from Destination to Source
  • # bytes from Source to Destination
  • # bytes from Destination to Source
  • Array containing delays in microseconds between packets in the flow
slide-23
SLIDE 23

23

W2SP2007 – Oakland, CA – May 24, 2007

Two Models Based on the Flow Sensor

Volume Packets Duration Balance Percentage Tiny: 1-128b Small: 128b-1Kb 4:10-99 5: 100-999 6: > 1000 4: 1000-10000 s 5: 10000-100000 s 6: > 100000 s Out >80

Low and Slow UPLOAD

Volume Packets Duration Balance Percentage Tiny: 1-128b Small: 128b-1Kb Medium: 1Kb-100Kb Large: > 100Kb 1: one packet 2: two pckts 3: 3-9 4: 10-99 5: 100-999 6: > 1000 0: < 1 s 1: 1-10 s 2: 10-100 s 3: 100-1000 s 4: 1000-10000 s 5: 10000-100000 s 6: > 100000 s Out >80

UPLOAD

slide-24
SLIDE 24

24

W2SP2007 – Oakland, CA – May 24, 2007

1 2 3 4 5 6 7

RECON ATTEMPT ATTEMPT ATTEMPT ATTEMPT ATTEMPT ATTEMPT UPLOAD UPLOAD UPLOAD DOWNLOAD DOWNLOAD UPLOAD RECON ATTEMPT

Phishing Attack Model 1 – very specific

UPLOAD

slide-25
SLIDE 25

25

W2SP2007 – Oakland, CA – May 24, 2007

1 2 3 4 5 6 7

ATTEMPT dst,src ATTEMPT dst,A ATTEMPT dst, src ATTEMPT dst,src ATTEMPT dst, ! src UPLOAD dst, src UPLOAD dst UPLOAD dst, src DOWNLOAD src DOWNLOAD src UPLOAD dst,src ATTEMPT dst, !src

Phishing Attack Model 2 – less specific

UPLOAD dst,src ATTEMPT dst, !src RECON or ATTEMPT

  • r COMPROMISE

RECON or ATTEMPT

  • r COMPROMISE dst

RECON or ATTEMPT

  • r COMPROMISE
slide-26
SLIDE 26

26

W2SP2007 – Oakland, CA – May 24, 2007

1 2 3 4 5 6 7

UPLOAD dst, src UPLOAD dst UPLOAD dst, src DOWNLOAD src DOWNLOAD src UPLOAD dst,src

Phishing Attack Model 3 – more general

UPLOAD dst,src RECON or ATTEMPT

  • r COMPROMISE

RECON or ATTEMPT

  • r COMPROMISE dst

RECON or ATTEMPT

  • r COMPROMISE dst, src

RECON or ATTEMPT

  • r COMP dst, src

RECON or ATTEMPT

  • r COMP dst, src

RECON or ATTEMPT

  • r COMP dst

RECON or ATTEMPT

  • r COMP dst, !src

RECON or ATTEMPT

  • r COMP dst,! src

RECON or ATTEMPT

  • r COMP dst, ! src

RECON or ATTEMPT

  • r COMPROMISE
slide-27
SLIDE 27

27

W2SP2007 – Oakland, CA – May 24, 2007

1 2 3 4

RECON ATTEMPT ATTEMPT or UPLOAD DOWNLOAD RECON

Phishing Attack Model 3 – Most general

ATTEMPT or UPLOAD ATTEMPT DOWNLOAD

Stricter models reduce false positives, but less strict models can detect unknown attack sequences

slide-28
SLIDE 28

28

W2SP2007 – Oakland, CA – May 24, 2007

Outline

1.Motivation and Terminology 2.Process Query System (PQS) Approach 3.Detection of a complex attack 4.Conclusion and Acknowledgments

slide-29
SLIDE 29

29

W2SP2007 – Oakland, CA – May 24, 2007

Contribution

  • Identification of a new generation of threats
  • Need for new paradigms of combining alerts

(observations)

  • Process Query System (PQS) based approaches to

detect complex attacks and covert channels

  • Need of reducing the gap between user perception

and what technology means (maybe explicit information about the real status of the system).

slide-30
SLIDE 30

30

W2SP2007 – Oakland, CA – May 24, 2007

Many thanks to professor George Cybenko (Thayer School of Engineering at Dartmouth College) and professor Shankar Sastry (EECS, UC Berkeley).

agiani@eecs.berkeley.edu