Spring 2016 Research Update Presentations UNIVERSITY OF ILLINOIS AT - - PowerPoint PPT Presentation

▶
spring 2016
SMART_READER_LITE
LIVE PREVIEW

Spring 2016 Research Update Presentations UNIVERSITY OF ILLINOIS AT - - PowerPoint PPT Presentation

Dec 07, 2023 278 likes •604 views

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE Spring 2016 Research Update

slide-1
SLIDE 1

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Spring 2016 Research Update Presentations

slide-2
SLIDE 2

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Monitoring Data Fusion to Improve Intrusion Detection

Atul Bohara P.I.: William H. Sanders ACC Seminar, Jan 27, 2016

2

slide-3
SLIDE 3

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Overview

  • Goal: protect a real-world networked system against

malicious activities

– E.g., Enterprise network / campus network / cloud data center – Prevention techniques are not sufficient – Need to rely on security monitoring and detection

  • Data-driven approach to combine information from

multiple monitors and detect intrusions

– Utilize the vast amount of information generated by security monitors – Detect sophisticated attacks

3

slide-4
SLIDE 4

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Recent Progress

  • Unsupervised anomaly detection in enterprise

system using clustering

– Identify useful features

  • Represent data in highly useful and concise format
  • Combine across different monitors

– Unsupervised machine learning

  • Apply clustering and dimensionality reduction

techniques to separate normal and anomalous behavior

  • Detect intrusions by analyzing anomalous behavior

clusters

4

slide-5
SLIDE 5

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Future Plan

  • 1. Develop techniques to represent and

combine data

  • 2. Develop unsupervised intrusion detection

techniques

  • 3. Apply them to systems such as campus

network, cloud data center

5

slide-6
SLIDE 6

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

INTRUSION DETECTION, RESPONSE, AND RECOVERY IN THE CLOUD

Student: Uttam Thakore P.I.: William H. Sanders

slide-7
SLIDE 7

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Quantitative Methodology for Security Monitor Deployment

  • A cost-effective methodology for monitor deployment to meet

intrusion detection goals

– Uses quantitative metrics to capture monitor utility and cost – Uses integer programming to determine optimal monitor deployment based on intrusion detection goals and cost requirements

  • Work last semester:

– Implemented heuristic approach to make solution algorithms scalable – Submitted paper to DSN 2016

  • Plans for the semester:

– Exploring collaboration with IBM to apply approach to IBM cloud

  • ffering
slide-8
SLIDE 8

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Unsupervised Anomaly Detection in Enterprise Systems Using Clustering

  • Applying unsupervised clustering techniques to

network- and host-level security logs to detect malicious behavior

  • Work last semester:

– Devised and implemented initial approach and evaluated on VAST 2011 Mini Challenge 2 data set – Submitted paper to HotSoS 2016

  • Plans for the semester

– Apply approach to NCSA security log data

slide-9
SLIDE 9

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Adaptive “Learning Responses”

– Deployment and configuration of monitors in response to detected attacker behavior to aid intrusion detection algorithms

  • Plans for the semester:

– Investigate existing tools and literature for predictive monitor selection – Apply unsupervised learning techniques to NCSA data to identify events that warrant additional monitoring

slide-10
SLIDE 10

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

A Flexible Fine-Grained Adaptive Framework for Parallel Mobile Hybrid Cloud Applications Kirill Mechitov PI: Gul Agha

slide-11
SLIDE 11

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

A Flexible Fine-Grained Adaptive Framework for Parallel Mobile Hybrid Cloud Applications

  • Research Problem

– Support hybrid mobile cloud computing – mobile devices leveraging cloud resources: secure private cloud + public cloud – Dynamic reconfiguration and offloading can achieve dramatic speedups (over 50x) for compute-intensive tasks such as image processing and/or mobile device energy savings – Security policies are needed to prevent unauthorized access and leakage

  • f sensitive information from secure devices and private clouds to public

clouds

  • Status & Plans

– Illinois Mobile Cloud Manager (IMCM) framework for hybrid MCC applications: prototype implemented – Optimize for different energy/performance objectives – Implement enforcement of actor semantics by the IMCM runtime

slide-12
SLIDE 12

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

IMCM: Illinois Mobile Cloud Manager

  • Code offloading:

– Automatic – Dynamic – Fine-grained – Parallel

  • Supports:

– Hybrid cloud with multiple cloud spaces

  • Provides:

– Policy-based control by cloud provider, app developer, user

slide-13
SLIDE 13

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

IMCM framework

Application Component Distribution

Elasticity Manager

Application actions Network parameters User context Application profiling Energy estimator

System Properties

  • Max app performance
  • Min mobile energy consumption
  • Min cloud cost
  • Min network data usage

Application Target Goal

  • Application Policy
  • Access Restrictions
  • User preferences

Org/App/User Policy System Monitor Policy Manager

Target goal Profiled exec Profiled comm

Offloading Plan Decision Maker

slide-14
SLIDE 14

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Research Plans

  • Enforce actor model

– Rather than assume well-behaved code or rely on compile-time enforcement – E.g., no out-of-band communication

  • Energy performace optimization

– Automate estimation of energy use by application components without user/programmer assist – Integrate with current constraint solver for dynamic runtime

  • ptimization
slide-15
SLIDE 15

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Moving towards a Secure Container Framework

Mohammad Ahmad, Rakesh Bobba, Sibin Mohan, Roy Campbell

slide-16
SLIDE 16

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Background

  • Container benefits

– Startup on the order of milliseconds – Packaging dependencies & portability

  • Container usage

– Platform as a Service Clouds – Openshift, DotCloud

  • Cross container side-channel attacks shown on

public clouds [1]

Zhang, Yinqian, et al. "Cross-tenant side-channel attacks in paas clouds." Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. ACM, 2014.

slide-17
SLIDE 17

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Secure Container Framework

  • Phase 1 – Defenses against cache based side-

channels

– Scheduling-based defenses

  • Cache flushing

– Incorporate hardware support

  • Intel Cache Allocation Technology to isolate parts of the LLC
slide-18
SLIDE 18

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Progress

  • Built a loadable kernel module

– Plugs into the Linux scheduler routine – Return probes (kretprobes)

  • Currently adapting relevant benchmark suites
slide-19
SLIDE 19

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

CRONets: Cloud-Routed Overlay Networks

Chris Cai PI: Professor Roy Campbell

slide-20
SLIDE 20

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Phurti: Application and Network-Aware Flow Scheduling for Multi-Tenant MapReduce Clusters

  • Phurti: Application and Network-Aware Flow Scheduling for Multi-Tenant

MapReduce Clusters (Chris Cai, Shayan Saeed, Indranil Gupta, Roy Campbell, Franck Le) has been accepted at IC2E 2016

  • Will be presented at the conference in April
slide-21
SLIDE 21

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

CRONets: Cloud-Routed Overlay Networks

  • We aim to understand what level of performance improvement can a

user expect to get from leveraging public cloud service to build overlay network, as opposed from other resource providers like ISPs.

  • Performance metrics can include throughput, latency, loss rate, etc,

corresponding to particular demands of different applications.

slide-22
SLIDE 22

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Measurement Testbed

  • We used PlanetLab nodes as clients and Eclipse mirros as servers. We used

IBM Softlayer as cloud provider to provide overlay nodes.

  • Blue labels indicate locations of PlanetLab nodes. Red labels indicate

locations of overlay nodes.

slide-23
SLIDE 23

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Ongoing work

  • Investigating
  • How persistent can a user expect the improvement to be over a

certain period, say, a week?

  • What types of network connections can expect the greatest

improvement?

  • How many overlay nodes are needed to achieve the best

performance?

  • How to automatically choose the best overlay path?
slide-24
SLIDE 24

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Monitoring through Inference

Imani Palmer P.I. Roy Campbell

slide-25
SLIDE 25

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

  • Current research:

– Determine the latest inferencing methods – Analyzed current methods – Defined a framework

  • Plans for the year:

– Build an inference engine – Define a set of policies for intrusion detection/VMI introspection case – Show a demonstration of the monitoring system cases

slide-26
SLIDE 26

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Research Update

Mainak Ghosh PI: Indranil Gupta

slide-27
SLIDE 27

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Project Status

  • Morphus and Parqua - Completed

– Supports reconfiguration in two popular NoSQL databases – MongoDB and Cassandra. – Reconfiguration involves changing table level configuration parameters like shard key which affects a lot of data at once. – Morphus was accepted as a conference (ICAC) and journal (IEEE TETC) publication. Parqua accepted as a short paper to ICCAC.

  • Getafix – Ongoing

– Real-time analytics system like Druid batch temporal data by time segments. They support aggregation queries like COUNT over a time interval. – For supporting high query throughput, segments are replicated. Current replication strategies are naïve which do not account for popularity. This leads to poor disk utilization. – In Getafix, we first propose an algorithm which provably gives the lowest replication factor required to maintain best query throughput. – We design and implement a new adaptive replication scheme in Druid which considers segment popularity. – Currently working on the implementation.

slide-28
SLIDE 28

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

A GAME THEORETIC APPROACH FOR SECURITY

Keywhan Chung Advisor: Professor Iyer, Professor Kalbarczyk

slide-29
SLIDE 29

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Status

  • Continued work with Dr. Kamhoua & Dr. Kwiat at AFRL
  • Game Theory with Learning for Cyber Security Monitoring

– Application of Q-Learning models for decision making under a released assumption/restriction of the attack model – Accepted & Presented at HASE 2016

  • Signaling Game

– Decision making is based on limited (and inaccurate) information – Signaling game derives the optimal decision given a possibly corrupted message (observation). – Attack model: SlowDoS

slide-30
SLIDE 30

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Progress

Completed

  • Preliminary Analysis of Web traffic @NCSA
  • Measurements on the victim web server under attack
  • Signaling Game simulator

In Progress

  • Formulation of the reward model and justification
  • Simulation based evaluation (accuracy)
  • Experiment on an actual web application (timeliness, accuracy)
slide-31
SLIDE 31

UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN | ENGINEERING AT ILLINOIS | INFORMATION TRUST INSTITUTE

Research update

Zak Estrada PI: Ravishankar K. Iyer

slide-32
SLIDE 32

Reliability and Security as a Service

  • Goal: Bringing VM Monitoring to the cloud

– Using Hprobes – Previous work on VM Monitoring

  • Runtime adaptability
  • Flexible fine-grained monitoring

– Parameters from DECAF (QEMU-based framework)

  • Whole system dynamic analysis to learn about guest OS
  • Status:

– Submitting to USENIX ATC (Feb 1st) – Collaborating w/Lok Yan @AFRL

  • Meeting at least 2/month