View
219
Download
0
Tags:
Embed Size (px)
Citation preview
Attack Attribution
Marc Dacier
Sr. Director, Collaborative Advanced Research Dept. (CARD)
Symantec Research Labs
2INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Overview
• Attack Attribution
• One example:
– the TRIAGE method (WOMBAT)
• Challenges, open issues
• Conclusions
3INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Collaborative Advanced Research Dept. C A R D
• CARD is part of Symantec Research Labs, within the CTO office.
• Worldwide team with members located in the USA (Culver City, California and Herndon, Washington DC) as well as in Europe (France and Ireland).
• Specificity: long term exploratory research carried out with external partners from academia and industry
4INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
What we do
• 2 recently completed projects:
– ANTIPHISH – EC funding (finished in June 2009)
– EC-CAM – US (finished in September 2009)
• 3 ongoing funded projects
– WOMBAT (EC)
– VAMPIRE (France)
– NICE (US)
• 2 new projects will start in 2010:
– Minestrone (US)
– VIS-SENSE (EC).
5INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Attack Attribution ….
• … is not about IP traceback
• … is about identifying the root causes of observed attacks by linking them together thanks to common, external, contextual “fingerprints”
6INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Analogy
• Serial killers accomplish a ritual that leaves traces
• Cybercriminals for efficiency reasons automate the various steps of their attack workflow and this leaves traces
7INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Danger
• "One swallow does not a summer make"
Aristotle, Nichomachean Ethics (384 BC - 322 BC)
The smiley face killer (?)
8INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Danger (ctd.)
• “When all you have is a hammer, everything looks like a nail”
Maslow's hammer law, The Psychology of Science,
1966
http://xkcd.com/587/
9INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Yes we can (find “things”)This is a worm
These are botnets
These are the threats we
should worry about
This is a stealthy, localised,
recurring event
Bridging the gap between such anecdotal findings and some actionable
knowledge is hard!
10
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Overview
• Attack Attribution
• One example:
– the TRIAGE method (WOMBAT)
• Challenges, open issues
• Conclusions
11
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Foreword
• What is presented here is the result of a joint collaboration between all WOMBAT partners over the last 28 months
(see www.wombat-project.eu for the list of publications and deliverables)
12
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
The WOMBAT approach
Data acquisition
(WP3)
Data enrichment
(WP4)
Threat analysis(WP5)
Stor
age
Anal
ysis
Meta-data
Analysis
New collectionpractices
Crawlers
HoneypotsNew security technologies
Context analysisMalware analysis
New security practices
External feeds Knowledge
13
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Example of a WOMBAT sensor: the SGNET data enrichment framework
Inte
rnet
Inte
rnet
Code Injection informationMalware
SGNET dataset
Models
Clusteringtechniques
13
AV identification
statistics
Generated alerts
Symantec ++
Behavioral Information
14
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Towards automated attack attribution
• Within WOMBAT, we have developed an automated framework that includes the expert knowledge in order to extract meaningful sets to reason about the modus operandi of the malicious actors: the TRIAGE framework
• First application of that approach led to significant contributions in the latest Symantec ISTR Rogue AV report
• Public deliverable D12 is available on line and contains 6 published peer reviewed papers on the topic as well as the rogue AV analysis technical report. – http://wombat-project.eu/WP5/FP7-ICT-216026-
Wombat_WP5_D12_V01_RCA-Technical-survey.pdf
16
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Names vs. IPs maps of Rogue AV sites
17
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Idea behind the attribution method
• Try to connect the dots…
17
18
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
TRIAGE
• TRIAGE1
– = atTRIbution of Attack using Graph-based Event clustering
• Multicriteria clustering method
18
1) Triage (med.): process of prioritizing patients based on the severity of their condition
19
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Successful attack attribution result
19
Time
750 domains registered over a span of 8 months
Email addr. hidden by privacy protection services
21
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
So, why is it useful...?
• Cyber criminality is a new business model
– Financial profits can be huge (large scale)
– Better organized - more systematic, automated procedures are used
• TRIAGE can help to:
– Get better insights into how cyber criminals operate, or how / when they change their tactics
• Consequently, help improving detection or end-user protection systems
– Automate the identification of “networks” of attackers• Unless they completely change their modus operandi for each campaign…
– Go toward an early warning system
– Ultimately, support law-enforcement for stopping emerging / ongoing attack phenomena
21
22
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Overview
• Attack Attribution
• One example:
– the TRIAGE method (WOMBAT)
• Challenges, open issues
• Conclusions
23
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
The need for data
• Attack attribution is an emerging field
• It requires a multi disciplinary approach and international collaboration
• It requires access to stable, representative and diversified sets of data.
• Everyone is welcome to host an SGNET sensor and benefit from the dataset and tools generated by the project.
• The more sensors we can get, the more we will learn about the attacks.
24
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
The Symantec WINE initiative
• Symantec owns a very rich amount of threats related datasets.
• CARD is currently building an infrastructure to provide access to a sampled set of these data feeds.
• External researchers are welcome to submit research proposals to gain access to this infrastructure, for free, on site.
• CONTACT POINT: [email protected]
25
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
Challenges and Open Issues
• A truly multidisciplinary domain:– Computer security, networking, knowledge mining, visualisation, law,
sociology, forensics, etc..
• Data can be private, confidential.
• Anonymisation is unlikely to be the silver bullet we need.
• Discovered knowledge can be sensitive ( from a technical, political, sociological or even business viewpoint).
• Do we have the right places to publish?
27
INCO-TRUST/NSF workshop, New York, USA, May 4, [email protected]
References
• Actionable Knowledge Discovery for Threats Intelligence Support Using a Multi-dimensional Data Mining Methodology, O.Thonnard (Royal Military Academy of Belgium) and M.Dacier (Symantec), Proc. of the IEEE Data Mining Workshops, 2008. ICDMW '08, Pisa, Italy, Dec. 15-19, 2008,
• Behavioral Analysis of Zombie Armies, O. Thonnard, W. Mees (Royal Military Academy of Belgium) and M. Dacier (Symantec), Proc. of Cyber Warfare Conference (CWCon), Cooperative Cyber Defense Center Of Excellence (CCD-COE), Tallinn, Estonia, June 17-19,
• Addressing the attack attribution problem using knowledge discovery and multi-criteria fuzzy decision-making, O. Thonnard, W. Mees (Royal Military Academy of Belgium) and M. Dacier (Symantec), Proc. of KDD’09, 15th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Workshop on CyberSecurity and Intelligence Informatics, Paris, France, June 28, 2009.
• Honeypot traces forensics: the observation view point matters, V.-H. Pham (Eurecom) and M. Dacier (Symantec), Proc. of the 3rd International Conference on Network and System Security, Gold Coast, Australia, Oct. 19-21, 2009