Internet of Things: Government Keynote, Randy Garrett
Download as PPTX, PDF1 like1,866 views
Randy Garrett gave a presentation on cyber security analytics and the Internet of Things for DARPA. Some key points: - DARPA has a history of developing new technologies to provide strategic advantage for national defense. - The interconnectivity enabled by modern technology has democratized access to sophisticated tools and information. - Physical systems like vehicles are increasingly vulnerable to cyber attacks as they become more connected to networks. - DARPA is pursuing research in areas like intuitive cyber situational awareness tools, encrypted computing, automated software analysis, and developing high-assurance cyber systems through formal methods.
![Our physical systems are vulnerable to cyber attacks…
Small group of academics took
control of a car using Bluetooth
and OnStar. They were able to
disable the brakes, control the
accelerator, and turn on the
interior microphone.[1]
Chinese cyber attack:
“Highly sophisticated and targeted
attack” on Google corporate
infrastructure (known as Aurora)
False speedometer reading
Note that the car is in park…[1] K. Koscher, et al. "Experimental Security Analysis of a Modern Automobile," in Proceedings of
the IEEE Symposium on Security and Privacy, Oakland, CA, May 16-19, 2010.
Approved for Public Release, Distribution Unlimited 9](https://image.slidesharecdn.com/garrettiot0806slides-140811105819-phpapp02/85/Internet-of-Things-Government-Keynote-Randy-Garrett-9-320.jpg)
![Encrypted computing in the cloud as privately as in
your data center (PROCEED‡)
Program Approach
• PROCEED is searching for efficient ways to compute on encrypted data that can be
implemented on modern computers
• Potential applications
• High assurance network guards
• Training simulators
• Image processing
It is theoretically possible to perform arbitrary computations on encrypted data without
decrypting. Thus, preserving security even on untrustworthy computational
infrastructure. [Gentry, 2009] [1]
What if all computation could be
done on encrypted data?
• Secure computational outsourcing
• System hardware and software
provenance concerns reduced
• Data provenance and availability
remain concerns
Will your
foreign-built
computer steal
your data?
‡ PROgramming Computation on EncryptEd Data (PROCEED)
[1] Craig Gentry. Fully Homomorphic Encryption Using Ideal Lattices.
41st ACM Symposium on Theory of Computing (STOC), 2009.
Approved for Public Release, Distribution Unlimited 13](https://image.slidesharecdn.com/garrettiot0806slides-140811105819-phpapp02/85/Internet-of-Things-Government-Keynote-Randy-Garrett-13-320.jpg)
Internet of Things: Government Keynote, Randy Garrett
- 1. Randy Garrett Government Keynote Program Manager, Information Innovation Office, Defense Advanced Research Projects Agency
- 2. Cyber Security Analytics: The Internet of Things Dr. Randy Garrett The views, opinions, and/or findings contained in this presentation are those of the author and should not be interpreted as representing the official views or policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the Department of Defense Approved for Public Release, Distribution Unlimited
- 3. DARPA History Approved for Public Release, Distribution Unlimited
- 4. I2O: information to operations • Cyber • ISR exploitation • New experts Information is a force multiplier Approved for Public Release, Distribution Unlimited
- 5. The Earth at Night NASA Earth Observatory/NOAA NGDC Distribution Statement “A” (Approved for Public Release, Distribution Unlimited) The views, opinions, and/or findings contained in this article/presentation are those of the author/presenter and should not be interpreted as representing the official views or policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the Department of Defense.
- 6. 6 Interconnectivity Distribution Statement “A” (Approved for Public Release, Distribution Unlimited) The views, opinions, and/or findings contained in this article/presentation are those of the author/presenter and should not be interpreted as representing the official views or policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the Department of Defense.
- 7. 7 •Instantaneous global communications •Low cost, rapid global transportation •Ubiquitous mass media •Encryption •High Resolution Satellite Imagery •Precision Navigation & Timing •Design & fabrication of sophisticated: parts, electronics, biological materials • IED’s, EFP, semi-submersibles •High performance computing •Capital Equipment • Jet fighters, Naval fighting vessels, long range artillery • Missiles (but not UAV’s, Tomahawks) • Nuclear Weapons (?) •State-of-the-art sensors •Sophisticated C2 •Large numbers of trained troops Democritization of Technology Available to Individuals: State Governments: Distribution Statement “A” (Approved for Public Release, Distribution Unlimited) The views, opinions, and/or findings contained in this article/presentation are those of the author/presenter and should not be interpreted as representing the official views or policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the Department of Defense.
- 8. Understanding Organizations and Their Relationships Traditional DOD (Nation State) Historic Military Counter-Insurgency Unexplored Territory Approved for Public Release, Distribution Unlimited
- 9. Our physical systems are vulnerable to cyber attacks… Small group of academics took control of a car using Bluetooth and OnStar. They were able to disable the brakes, control the accelerator, and turn on the interior microphone.[1] Chinese cyber attack: “Highly sophisticated and targeted attack” on Google corporate infrastructure (known as Aurora) False speedometer reading Note that the car is in park…[1] K. Koscher, et al. "Experimental Security Analysis of a Modern Automobile," in Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, May 16-19, 2010. Approved for Public Release, Distribution Unlimited 9
- 10. Approved for Public Release, Distribution Unlimited •Real-time cyberspace analytics •Intuitive views and interactions •Single fused situational awareness •Machine execution •Assured and integrated battle damage assessment •Work with range of skill sets, novice to expert Plan X A single view of the cyber battlespace for planning, operation and situational awareness Core Plan X Technology Base Intuitive Interfaces Cyber battlespace analytics Mission Planning Capability Database Platforms Mission Execution Plan X System network mapping data deploy, operate, measure
- 11. 11 Scalable analytics & data processing technology Technical Area 1 - XDATA Quadratic scaling O(n^2) Correlation of subsets of data Statistics for an n^2 scaling analytic based on 20K records with feature vector length of 8000 used to generate a correlation coefficient matrix. Data locality (random access seek times) along with CPU usage are the primary factors in execution. *Actual measured times other times above are estimated n^3 scaling O(n^3) PCA/SVD, betweenness, force-directed layout “Betweenness” using 4.7 million nodes and 29 million edges1. 1 AFRL 2011 Small Medium Large Huge Massive Approved for public release; distribution is unlimited. • Propagation of uncertainty • Measuring non-linear relationships • Sampling and estimation techniques for distributed platforms • Methods for distributed dimensionality reduction, matrix factorization etc. • Streaming data feeds • Optimal cloud configurations and resource allocation with asymmetric components Challenges to achieve practical solutions with know accuracy in realistic environments Reduction methods?
- 12. Getting convergent: Manageable diversity (CRASH‡) Management Interface & Dynamic Loader Component Map Dependency Map Diversity Management Middleware Address space layout randomization Instruction set randomization Functional Redundancy Methodij Taski Randomization of Lower Layers High-Level Visible Layers to User Remain Unchanged New architectures guided by biology Attacker System Users System Managers Make all systems look the same to the system users and managers, but different to the attackers. • Preventing common attacks. • Adapting in response to unanticipated attacks. • Create diversity so attacker has to deal with heterogeneity. ‡ Clean-slate design of Resilient, Adaptive, Secure Hosts Approved for Public Release, Distribution Unlimited 12
- 13. Encrypted computing in the cloud as privately as in your data center (PROCEED‡) Program Approach • PROCEED is searching for efficient ways to compute on encrypted data that can be implemented on modern computers • Potential applications • High assurance network guards • Training simulators • Image processing It is theoretically possible to perform arbitrary computations on encrypted data without decrypting. Thus, preserving security even on untrustworthy computational infrastructure. [Gentry, 2009] [1] What if all computation could be done on encrypted data? • Secure computational outsourcing • System hardware and software provenance concerns reduced • Data provenance and availability remain concerns Will your foreign-built computer steal your data? ‡ PROgramming Computation on EncryptEd Data (PROCEED) [1] Craig Gentry. Fully Homomorphic Encryption Using Ideal Lattices. 41st ACM Symposium on Theory of Computing (STOC), 2009. Approved for Public Release, Distribution Unlimited 13
- 14. Approved for Public Release, Distribution Unlimited. Active Authentication Fingerprint Ridge Ending Ridge Bifurcation Core Island Forensic authorship Average word length Type-token ratio Use of Punctuation Use of unique words Mouse tracking Time over a single location Drifting while reviewing topics Double click Hovering to review alt-text Repurposed TechnologyExisting Technology New Technology Source: epdeatonville.orgwp-content uploads2011 04fingerprint.jpg Source: The Mancurian Candidate, Robert Graves, P2, Amazon PreviewSource: google search for "real estate" with mouse tracking provided by IOGraph Biometric Identity Modalities Beyond passwords Objective Validate the individual at the keyboard by those unique factors that make up the individual. Approach Focus on software biometrics (those without hardware sensors). Rotate many different biometrics as the human at the keyboard is working, resulting in an invisible authentication method.
- 15. Approved for Public Release, Distribution Unlimited Objective • Develop new program analysis tools and techniques for detecting malicious functionality in mobile applications. • Seek fundamental advances in program analysis that might enable DoD to vet other kinds of software, too. Approach • Produce practical automated analysis tools designed to keep malicious code out of DoD mobile application marketplaces. • Translate goal of keeping malicious code out of DoD mobile application marketplaces into lower-level properties that can be proven with automated program analysis tools. Automated Program Analysis for Cybersecurity (APAC) Third-party developers submit mobile apps to DoD. Some contain hidden malicious functionality. DoD analysts keep mobile app store free of malicious apps. Develop new tools and techniques for vetting mobile apps. APP APP STORE 15
- 16. Objective •Fully-automated checks for broad classes of malicious features and dangerous flaws in software and firmware Approach •Detect attacks we have never seen before that are not based on signatures • Define malice: • Determine broad classes of hidden malicious functionality to rule out • Confirm the absence of malice: • Demonstrate the absence of those broad classes of hidden malicious functionality • Examine equipment at scale: • Scale to non-specialist technicians who must vet every individual new device used by DoD prior to deployment VET: Vetting Commodity IT Software and Firmware Smart Phones Routers Printers Approved for Public Release, Distribution Unlimited http://www.dtic.mil/whs/esd/cmd/index.htm http://broadband.mt.gov/providers.aspx http://www.benning.army.mil/library/content/MCoELibrariesEResources/mcoelibrarieseresources.htm http://www.mc4.army.mil/hardware/Printers Examples Images of specific hardware are for illustration only and should not be interpreted as implying vulnerabilities 16
- 17. Objective: • Cost-effective construction of high- assurance cyber-physical systems. • Functionally correct. • Satisfy appropriate safety and security properties. Approach: • Use clean-slate formal methods • Produce high-assurance operating system components and control systems. • Develop a suite of program synthesizers and formal-methods tools. • Generate an integration workbench containing all HACMS tools and assured components. High Assurance Cyber Military Systems Proof • im • sa • sa when • on de • in en Idea: Synthesize & Verify Hig 12/8/11 “If soft by its m vulnera easier Felix Li High Assurance: Correctness, Resource Constraints Environment Description Functional Specification Synthesizer Code Proof Diagnostic Information Hardware Description Verified Libraries Safety Policy Security Policy Clean-slate formal-methods-based approach Approved for Public Release, Distribution Unlimited 17
- 18. Cyber Grand Challenge Objective: A Cyber Grand Challenge for automated defenders similar to DEFCON Capture the Flag Approach: Create automated systems that can sense and respond to cyber attacks more rapidly than human operators Compete systems that can engage in counter-adaptation cycles and repel novel threats from networks • Anomaly detection, big data analytics, case-based reasoning, heuristics, game theory, and stochastic optimization Compete at a high level in cyber competitions Flag Monitoring Vulnerability Scan Service Poller Mixed Inputs Key Competition Testbed Further dissemination only as directed by DARPA Public Release Center or higher DoD authority
- 19. Dark Nebula © Robert Traube Distribution Statement “A” (Approved for Public Release, Distribution Unlimited) The views, opinions, and/or findings contained in this article/presentation are those of the author/presenter and should not be interpreted as representing the official views or policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the Department of
- 20. www.darpa.mil 20 Distribution Statement “A” (Approved for Public Release, Distribution Unlimited) The views, opinions, and/or findings contained in this article/presentation are those of the author/presenter and should not be interpreted as representing the official views or policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the Department of Defense.