Cyber-Security Via Computing With Words

Transcription

1 Cyber-Seurty Va Computng Wth Words John. Rkard Dstrbuted Infnty, In Shoshone Drve Larkspur, CO 808 Emal: ABSRAC Cyber-seurty systems must deal wth a hgh rate of observable events essentally n real tme. In order to detet malous behavors on a network, these raw events typally must be aggregated nto features orrespondng to hgher-level desrptons of network atvtes, from whh nferenes an be made onernng suspous behavors. hs paper employs a omputatonally feasble approah to formulatng human- or mahne-generated queres n large yber-networks, usng word desrptons of both the features and the queres. he word desrptons are modeled usng nterval type- (I) fuzzy membershp funtons (MF) on an approprate sale. By pre-omputng and storng approprate desrptors of these MFs, we an perform automated montorng of large ybernetworks n real tme. We llustrate our approah wth an etended eample. I INRODUCION In prevous work [], we desrbed an approah to pereptual omputng n soal networks, based upon Yager s Paradgm for Intellgent Soal Network Analyss (PISA) [],[3]. hs work etended Yager s results to the use of nterval type- (I) membershp funton (MF) representatons of word voabulares desrbng node attrbutes and relatonshps. he advantage of ths approah s that t enables us to partton features havng ontnuous ranges of values nto a set of word desrptors havng an adequate degree of preson to perform query operatons, whle substantally redung the omputatonal requrements. In a reent paper [4] we etended ths approah to word-based queres of yber-networks, n whh the nodes onsst of both users and network deves. he understandng of yber network behavor requres ntellgent queres of Allen Ott Dstrbuted Infnty, In. 38 Quartz Mountan Drve Larkspur, CO 808 Emal: [email protected] large volumes of very detaled data that s at the same tme mprese wth respet to nluson n any gven behavor dentfaton. For eample, tme of day of a remote logn to a database server s typally reported n mllseonds of Unversal me n the yber network event stream and the relevant desred nformaton s whether or not the logn ourred durng the normal work day. he symbol word desrptons enable and manage the mpreson wthn the detaled data through word desrptons of the feature spae, and enable fully modeled desrptons of the behavor through word desrptons of the queres. hs paper employs the analytal foundaton n [4] to llustrate ts applaton n yber-seurty. II REVIEW OF ECHNICAL APPROACH We frst revew some of the tehnal bakground provded n []-[4]. A yber-network onssts of a set X of nodes eah haraterzed by a olleton of attrbutes U on whh a vetor fuzzy set F ( U ) s defned. For eample, U mght represent the eperene level and the omputer sene sklls of a system user, and elements of F mght then nlude fuzzy sets rangng from nove to guru n the frst nstane, or very low to epert n the seond nstane. Alternatvely, U mght represent the frequeny of aesses to a set of fles and the level of traff over a port n a network deve. In ths ase, the element of F mght then nlude fuzzy sets rangng from seldom ever to very often n the frst nstane, or very low to very hgh n the seond nstane. A fuzzy relatonshp Ry (,): XX 0, represents the strength of the onneton between nodes, y X, where a node an be ether a person or a deve. Suh a onneton mght desrbe, for eample, the ntensty of ommunatons between two users, or between ASE 04 ISBN:

2 two deves, or between a user and a deve on the network. ypally, many dfferent relatonshps wll be of nterest n haraterzng a yber-network, eah of them havng ts own desrptve matr funton Ry. (,) R( y,) represents the dret lnk strength between a par of nodes wthout any ntervenng lnks. hs s generalzed through the omposton operator defned by R (,) z R(,) zr(,) z ma mn Ry (, ), Ryz (, ), () yx y, z where by onventon, R 0 (,) z 0 and R (,) z R(,) z, and by the reursve relatonshp k k R (,) z R(,) zr (,) z () k From (), R (,) z s the strongest onneton between and z nvolvng at most k ntervenng lnks. hese defntons are etensble to type- fuzzy membershps for the elements of F and R, whose MFs are defned n terms of ther -uts F and R []-[4]. he type- formulaton an further be etended to I fuzzy sets, where these sets are used to represent words desrbng the attrbute membershps and relatonshp strengths. Use of I fuzzy sets to desrbe these words aptures both the granularty and the mpreson n the meanngs of suh words. hs Computng wth Words (CWW) approah orgnally was proposed by Zadeh [5] and later advaned by Mendel and Wu [6], and t provdes an analytal means of epressng the often mprese knowledge of node membershps and lnk strengths, as ompared to usng rsp sngleton values. he strength of a path,,, 0 n a set of nodes s defned by between S ( ) m n R (, ),,, 0,, (3) for eah -ut, whle the path length s defned by L ( ),,, 0,. (4) n R (, ) he measures S ( ) and L () an n turn be used to desrbe suh terms as strong path or short path, from whh we defne addtonal network features and desrptons. wo of partular nterests n yber-networks are a work group and the entralty of a partular node. A work group Q mght for eample be defned as a subset of users and network deves n X suh that ) all elements n Q are onneted by short strong paths, and ) no element not n Q s onneted to any element n Q by a strong path. th he k -order entralty of a node may be defned as the normalzed sum of the strengths of the strongest paths between ths node and all other nodes n the network,.e., n k, j C R n j j. (5) Note that (5) provdes a measure both for the entralty of a gven user n a yber-network and for a gven deve on the network. Furthermore, one an restrt the sums n (5) to alulate four dfferent degrees of entralty approprate to yber-networks: ) between a gven user and all other users; ) between a gven user and all network deves; 3) between a gven network deve and all users; and 4) between a gven network deve and all other network deves. Eah of these entralty measures has ts own ASE 04 ISBN:

3 mportane relatve to queres and automated montorng funtons for yber-networks. A partularly powerful mean-type aggregaton operator known as the weghted power mean (WPM) was etended to I fuzzy nputs and weghts n [7],[8]. he WPM aptures several ommonly employed averagng operatons suh as the mnmum, harmon mean, geometr mean, arthmet mean, root-mean square and mamum, dependng upon the eponent p hosen. A further etenson to non-mean, thresholdng type aggregaton operators s desrbed n a forthomng par of papers [9],[0]. hese latter aggregaton operators aount for all-n and all-out type desons at threshold values ontrolled by a sngle parameter. WPM operators an also be used to onstrut onjuntve or dsjuntve partal absorpton operators [],[]. Conjuntve partal absorpton operators enable us to desgnate ertan of the nput varables as mandatory, n the sense that a good sore n eah of these nputs s neessary to produe an aggregate good sore, whle the other nputs are smply desrable, n the sense that a good sore n any of these enhanes the output sore but s not neessary to aheve a good overall sore. Smlarly, dsjuntve partal absorpton operators enable us to desgnate ertan of the nput varables as suffent, n the sense that a good sore n any one of these varables produes an aggregate good sore. he general dea behnd ths style of CWW s to spefy a voabulary of desrptve nput and mportane words, along wth ther orrespondng I MFs defned for eample on a sale of 0,0, and then spefy the type of nferene engne desred. Gven ths set of nput and mportane words, the engne omputes a orrespondng output I MF, whh may then be used dretly as omputed, or t may be deoded nto a word from an output voabulary va smlarty omputatons wth respet to the I MFs representng these output words. A ommonly used salar smlarty measure s the Jaard smlarty [3], whh provdes a symmetr, salar measure of the smlarty between two I MFs. In other nstanes, we may wsh to determne the degree to whh an output I MF A satsfes a ertan property, e.g., path shortness n a ybernetwork, as haraterzed by an I MF B. In these ases, we use the subsethood measure ss AB, to determne ths degree of satsfaton,.e., the degree to whh A s a subset of B. We employ a salar measure of ths quantty as proposed by Vlahos and Sergads [4]. Note that smlarty s a symmetr relatonshp between ts arguments, whereas subsethood s not. Further note that the doman X need not neessarly be one-dmensonal. For eample, we ould ompute the smlarty between two network proesses n a three-dmensonal work flow spae onsstng of team attrbutes, onnetons to servers, and data flow between team members, where the subjet enttes may be defned only mpresely va I fuzzy sets. III WORD QUERIES OF CYBER- NEWORKS Use of word representatons va I fuzzy MFs allows us easly to spefy both attrbutes and relatonshp strengths n a yber-network usng relatvely stat voabulares, rather than dealng wth a ontnuum of numeral values, and further enables us to perform word queres on these quanttes and ther dervatve features. Sne human nterpretaton of numeral values s almost always n terms of qualtatve epressons, we smply spefy a set of overlappng I MFs approprate to a gven voabulary and use words from these voabulares to desrbe node attrbutes and relatonshp strengths on the network. We an pre-ompute and store many of the quanttes of nterest n a yber-network. For eample, n plae of omputng the path strength of a gven path as n (3), the -ut representatons of the varous ombnatons of voabulary words an be pre-omputed and stored, and are then avalable for reall hs enables us to employ smple reall proessng n plae of omputatonally ntensve on-the-fly proessng. For eample, onsder the ase where 7-word voabulares are used to desrbe the elements of F and the relatonshp strengths R. hen we pre-ompute 777 = 343 I MFs for the ASE 04 ISBN:

4 possble ombnatons of F and R between any par of nodes and store the -uts, entrod ntervals and defuzzfed salar values orrespondng to these MFs. Gven the flow of event reords desrbng the dynams of a vrtual yber-network, ths provdes a hghly desrable tradeoff, even n ases where relatvely large voabulares may be requred. A smlar approah an be appled to path length alulatons as n (4). By employng the above approah, we also eplot the generalty of I representatons of attrbutes and relatonshps, whh apture the nherent mpreson n desrbng the mappng of atvtes to yber-networks, wthout payng a potentally nfeasble pre for on-the-fly omputatons nvolvng these quanttes n queres and/or dynam modelng for large vrtual networks. As well, a sophstated adversary frequently eplores hard thresholds n queres desgned to detet suspous atvty and then attempts to eplot suh knowledge to avod trggerng alerts. Our ablty to defne fuzzy boundares of nlusveness wth I funtons greatly omplates the ablty for a sophstated adversary to hde nefarous atvty usng ths approah. IV EXAMPLES Consder a yber-network whose nodes onsst of a set of users and a set of deves. he users are desrbed by a set of attrbutes F, wth a relatonshp R that haraterzes the strength of onneton wth other users, e.g., the frequeny of ommunatons va hat, emal, or sharepont type onneton. In general, the th attrbute for th the j ndvdual s desrbed by an I MF F j, orrespondng to a voabulary word B F, where j F B s the voabulary hosen for the r R of the relatonshp j R between user th attrbute n F. Smlarly, eah element, j, R and user j s desrbed by an I MF ( ) j orrespondng to a voabulary word R j B, f R where B s the voabulary hosen for the relatonshp. For llustratve purposes, suppose that f s the attrbute desrbng the eperene level and f s the attrbute desrbng the software adaptaton skll of the th user and r j, s the relatonshp strength of user to user j, eah desrbed n words drawn from ther respetve voabulares F F R B, B and B shown n ABLE I. he orrespondng trapezodal MFs for the UMFs () ( ) and LMFs () ( ) are shown n ABLE II, where the fve parameters of a trapezodal funton trap (,, h lbltrtrb,,, ) followng ts argument are heght ( h ), left bottom ( lb ), left top ( lt ), rght top ( rt ) and rght bottom ( rb ), respetvely. For purposes of ths eample, we use the same set of MFs for eah voabulary, but n general these MFs may unque for eah voabulary. F F VOCABULARIES B, ABLE I B AND R B FOR HE ARIBUES EXPERIENCE LEVEL, COMPUER SCIENCE SKILL AND RELAIONSHIP SRENGH. Eperene Level Nove (N) Software Adaptaton Skll Very Low (VL) Relatonshp Strength Voabulary MF None/Very Weak (NVW) () ( ) Amateur (A) Low (L) Weak (W) () ( ) Modest (M) Intermedate (I) Consderable (C) Substantal (S) Guru (G) Modest (M) Farly Weak (FW) (3) ( ) Average (A) Casual (C) (4) ( ) Moderately Hgh (MH) Moderately Strong (MS) (5) ( ) Hgh (H) Strong (S) (6) ( ) Very Hgh (VH) Very Strong (VS) (7) ( ) hus, for eample, the th user mght have the attrbute values f = Consderable and f = Average n ABLE I, represented by orrespondng I MFs (5) () and (4) ( ) ASE 04 ISBN:

5 defned on the doman 0,. he hoe of 0, as the doman enables us to map the subjetve judgments of eperene level and software adaptaton skll nto unt ranges approprate to users on a gven network. ( ) trap (,,0.5,0.85,,) SC ( ) trap (,,0.7,0.95,,) SC ( ) trap (,,0.65,0.85,,) HS ( ) trap (,,0.75,0.9,,) HS (6) Suppose now that the th user s attemptng to dentfy a set of network resoures apable of ondutng a spef eplot. He then may wsh to dentfy teams wth strong onnetons va at most k lnks to ndvduals havng hgh software adaptaton sklls. MF () () ABLE II RAPEZOIDAL UPPER AND LOWER MFS FOR VOCABULARY WORD MFS. rapezodal Upper and Lower MFs () ( ) trap (,,0,0,0.6,0.47) () () trap (,,0,0,0.0,0.43) he th j users ( j ) membershps SC (,) j and HS( j ) n these lasses are alulated as the followng epresson, where ssa, B denotes subsethood: k SC(,) j ss R (, ), () j SC. (7) HS() j ss (), () j HS () () (3) () (4) () (5) () (6) () () () trap(,,0.00,0.04,0.73,0.434) () () trap (,0.03,0.04,0.76,0.76,0.) (3) ( ) trap (,,0.04,0.69,0.557,0.83) (3) () trap (,0.36,0.366,0.49,0.49,0.46) (4) () trap (,,0.04,0.40,0.66,0.87) (4) () trap (,0.36,0.48,0.5,0.5,0.563) (5) () trap (,,0.43,0.63,0.84,0.997) (5) () trap (,0.39,0.673,0.78,0.78,0.765) (6) () trap(,,0.337,0.774,,) (6) () trap(,,0.739,0.98,,) he degree (,) j to whh ndvdual j( j ) satsfes ths rteron an be alulated usng a sngleton-nput WPM wth eponent p denoted as, p w, where s the vetor of nputs and w s the vetor of mportane weghts (here assumed to be equal): SC (, j) (, j), p. (8) HS() j (7) () (7) () trap(,,0.59,0.90,,) (7) () trap(,,0.877,0.99,,) Let () and () be I MFs for the SP HS lasses strong onneton and hgh software adaptaton skll, defned on the 0, domans of path strength and software adaptaton skll, respetvely. In partular, let these MFs be spefed by he hoe of p determnes the degree of onjunton requred of the satsfatons of the two rtera strong onneton and hgh software adaptaton skll. Dfferent weght values an be used f one of these rtera s more mportant than the other. Computng (,) j for eah j and rankng the results provdes a lst of prospetve network resoures n order of ther sutablty. Reall that the results for both R k (, ) and ( ) n (7) have been pre-omputed and j stored; therefore t s only neessary at most to perform the subsethood alulatons. However, j ASE 04 ISBN:

6 f the lasses strong onneton and hgh software adaptaton skll are of general nterest n queres, these subsethood alulatons too an be pre-omputed and stored for eah ombnaton of (word) values for the frst arguments, so that only reall proessng and smple arthmet alulatons are requred to ompute the values n (8). For llustraton, suppose we onsder a network of seven users, where ndvdual # s the potental perpetrator. Assume the attrbute vetors for eperene level f and software adaptaton skll f are gven by (see ABLE I) SC () SC () HS () We note that for ths eample, SC () k SC () for k. From (8) wth p 0.7, the vetors of rteron satsfaton for node elements through 7 for k, are gven by f I C M S I G N, (9) f M M H VL M H VH A () * () * () and the relatonshp strength matr R s gven by M S W W VS C VW FW VW C C M S S S W W VS W C R W C FW M S VW VW,(0) MS W FW FW S VS VW C VW VW M S S VS W M S VW W C where the dagonal s orrespond to sngleton MFs at unty value and are not nvolved n our omputatons. he orrespondng vetors SC () k of degrees of strong onneton between node and the remanng nodes for k, and the vetor HS of degrees of hgh software adaptaton skll for these nodes -7 are alulated from (7) as: hus the potental perpetrator s best anddates would be users #5 and #6, whh have nearly equal sores, wth user # a dstant seond. he two hghest sores for () reflet the Very Strong onneton between user # and user #5, who n turn has a Strong onneton to user #6, n ombnaton wth ther respetvely Hgh and Very Hgh software adaptaton skll. Now suppose that our potental perpetrator s leveragng a strategy that wll be more effetve and rase less suspon f lmted to more eperened network users, and partularly those wth hgher software adaptaton sklls. He mght then wsh to query hs yber-network ste wth a desre for strong onnetons to more eperened users, for whom hgh software adaptaton skll s mandatory. In ths ase, let ( ) be the I MF for the lass more ME eperened user, where the membershp of ndvdual j n ths lass s gven by M E( j) ss ( ), ( ). (3) j M E ASE 04 ISBN:

7 We then would use a partal absorpton operator [] wth the mandatory nput beng HS() j and the desred nputs beng a onjunton (of spefed degree p ) between SC () j and ME() j. hs partal absorpton operator omputaton nvolves ) a weghted partal dsjunton (denoted ) of the mandatory nput and the onjunton of the desred nputs (usng a WPM (, w ) for the dsjunton wth eponent pd d p and a WPM (, w ) for the onjunton d p wth eponent p ) followed by ) a weghted partal onjunton (denoted ) of the mandatory nput wth the result from ) (usng a WPM (, w ) wth eponent p ). p In a type- fuzzy ontet, neessarly s zero f s zero, and for non-zero, s postve (resp. negatve) when s greater (resp. less) than. he absolute dfferene s alled the reward when s greater than, and s otherwse alled a penalty []. We onstrut the operator from nested weghted power means as: whose footprnt of unertanty (FOU, the regon between the UMF and LMF) s shown n Fgure below. Fgure. FOU of the user lass more eperened. Settng a penalty of -5% and a reward of +5%, wth p 0.7, p 5.80 and p 0.69, we d obtan from (4) the vetors of rteron satsfatons for paths of length, k : HS() j HS() j () j, p (), w p SC j w d, d p w ME() j where w, p, d d w and p are hosen to aheve the desred reward and penalty values as desrbed n []. Agan, sne the varables n the weghted power means n (4) have been pre-omputed, only arthmet operatons must be performed to arrve at ths result. Let the more eperened user lass membershp funton orrespond to that of S n ABLE I (.e., () (6) () n ABLE II), ME () * (5) () * ,(4) hus, user #6 s now learly the best anddate, as he has both Guru level eperene and Very Hgh software adaptaton skll, wth user #5 provdng a reasonably strong math due to hs ombnaton of Intermedate eperene level and Hgh software adaptaton skll. User # s a somewhat lesser anddate, havng Consderable eperene level, but only Moderately Hgh software adaptaton skll. One an observe how makng software adaptaton sklls a mandatory rteron has put more dstane between the sores of user #6 and the remanng users who have lesser software adaptaton skll. o further plot hs eplot, our potental perpetrator may wsh to know the strength of the ASE 04 ISBN:

8 entralty of the other users n the network. he I entralty C(;) k of the th user over a mamum of k lnks s alulated usng (5) on the upper and lower MFs of R. We then alulate the subsethood of C(;) k n the set strong onneton havng MF () as n (6) and (7),.e., SP ((;)) C k ss C ; k, (). (6) hs yelds the followng vetors of entralty strengths CS() k for k,, wth CS( k) CS () for k : CS() CS() SC SC (7) hus user #4 has the lowest strength of entralty of any of the users, whh dependng on the nature of the eplot may prove to be an advantage or dsadvantage to the perpetrator. As a fnal query, the perpetrator may wsh to know the degree to whh users #5 and #6 onsttute a work group to themselves. As defned above, ths would be the degree to whh users #3 and #5 are onneted by short strong paths, and no other users are onneted to them by a strong path. Performng ths alulaton yelds a degree of 0, ndatng that these users are not an solated workgroup. V CONCLUSION We have etended the soal and yber-network onstruts of []-[4] to the pereptual omputng doman for yber-networks usng word representatons of attrbute membershp and relatonshp strengths between users. In partular, we have dentfed means for feasbly performng alulatons usng these onstruts n large vrtual networks by pre-omputng and storng the ombnatons of attrbute/relatonshp words nvolved n the typally relatvely small voabulares requred n yber-networks. We are presently workng on the applatons of these approahes to dynam network modelng usng fuzzy ogntve maps. ACKNOWLEDGEMENS hs materal s based on researh sponsored by the Unted States Ar Fore Aademy under agreement number FA he U.S. Government s authorzed to reprodue and dstrbute reprnts for Governmental purposes notwthstandng any opyrght notaton thereon. he authors aknowledge the use of the USAF Aademy Center for Cyberspae Researh, nludng adet teams to develop prototype software and smulaton senaros. Graph onstruton apablty and salablty was eplored and evaluated by Leutenant Bryan Hall and Leutenant Josah Lane usng smulated ybernetwork reords. her work was etended to nlude the perepton engne voabulary attrbutes. he applaton of mprese queres and graph smlarty was evaluated by Leutenant Ellot Unseth and Leutenant Jon Beabout. he mprese graph smlarty researh was etended wth the pereptual omputng I Fuzzy approah. DISCLAIMER he vews and onlusons ontaned heren are those of the authors and should not be nterpreted as neessarly representng the offal poles and endorsements, ether epressed or mpled of the US Ar Fore Aademy or the US Government. Referenes [] Rkard, J.. and R.R. Yager, Pereptual omputng n soal networks, paper #9, Pro. Internatonal Fuzzy Syst. Asso. World Congress/North Ameran Fuzzy Inform. Pro. So. Annual Mtg., Edmonton, Alberta, Canada, June 03. [] Yager, R.R., Intellgent soal network analyss usng granular omputng, Int. J. Intell. Syst., vol. 3, no., pp. 96-9, Nov [3] Yager, R.R., Conept representaton and database strutures n fuzzy soal relatonal networks, IEEE rans. Syst., Man, Cybernets, Part A: Syst. and Humans, vol. 40, no., pp , Marh 00. [4] Rkard, J.. and A. Ott, Queryng ybernetworks usng words, submtted to World ASE 04 ISBN:

9 Conferene on Soft Computng 04, Berkeley, CA, May, 04 [5] Zadeh, L., Fuzzy log = omputng wth words, IEEE rans. Fuzzy Syst., vol. 4, no., pp. 03-, May 996. [6] Mendel, J.M. and D. Wu, Pereptual Computng: Adng People n Makng Subjetve Judgments, Psataway, NJ: IEEE Press, 00. [7] Rkard, J.., J. Asbett, R.R. Yager and G. Gbbon, Fuzzy weghted power means n evaluaton desons, Pro. World Symposum on Soft Computng, Paper #00, San Franso, CA, May 0. [8] Rkard, J.., J. Asbett, R.R. Yager and G. Gbbon, Lngust weghted power means: omparson wth the lngust weghted average, Pro. FUZZ-IEEE 0, 0 World Congress on Computatonal Intellgene, pp. 85-9, ape, awan, June 0. [9] Rkard, J.. and J. Asbett, New lasses of threshold aggregaton funtons based upon the salls q-eponental wth applatons to pereptual omputng, to appear n IEEE rans. Fuzzy Syst. [0] Asbett, J. and J.. Rkard, Centrods of type- and type- fuzzy sets when membershp funtons have spkes, to appear n IEEE rans. Fuzzy Syst. [] Dujmovć, J.J., Contnuous preferene log for system evaluaton, IEEE rans. Fuzzy Syst., vol. 5, no. 6, pp , De [] Dujmovć, J.J., Partal absorpton funton, J. Unv. Belgrade, EE Dept., ser. Mathemats and Physs, no. 659, pp , 979. [3] Jaard, P., Nouvelles reherhes sur la dstrbuton florale, Bulletn de la Soete de Vaud des Senes Naturelles, vol. 44, p. 3, 908. [4] Vlahos, I. and G. Sergads, Subsethood, entropy, and ardnalty for nterval-valued fuzzy sets an algebra dervaton, Fuzzy Sets and Systems, vol. 58, pp , 007. ASE 04 ISBN: