start	end	text
0	13520	Specifically, I work in the Information Systems Technology Program, which is a, it's a very applied approach to engineering, and specifically information technology systems.
13520	28180	We're currently at the University of Central Florida developing a undergraduate security program that I'm also, I'm the one that's mainly involved in developing that, and that's actually what my second talk a little bit later is on today.
28180	32470	But this is the more, maybe more interesting, more technical one.
32760	40860	My past research includes the correlation of distributed, distributed network sensors.
40860	52180	If you have a, if you have a large scale network, you have intrusion detection systems, you have firewalls, you have other things that are recording information saying what's going on on the network.
52180	64240	Trying to correlate that information together, to bring it all together and trying to see the big picture of what's going on, rather than getting these little kind of half views of what's really occurring out on the network.
64240	72400	And also I'm working on some projects that involve combined data sharing networks for law enforcement in the state of Florida.
73860	83540	You know, this little blurb ad about the University of Central Florida, it's down in Orlando, Florida. It's about, we've got about 42,000 students there, about 5,500 of which are in engineering.
83620	87980	We're located about 13 miles east of Orlando, Florida.
89760	96060	As I said, the Information Systems Technology Program, this is a really, it's an applied engineering degree.
96060	103780	It's very hands-on, very real world, very current tools, not so much the traditional theoretical approach to engineering.
105000	108420	A heavy concentration of hands-on learning in the program.
109440	116720	A little bit about the background of what led me to this current idea.
117620	123960	There was a previous research that I worked on, I gave a couple of presentations back at DEF CON 9 and 10.
123960	133680	And this was on using Bayesian multiple hypothesis to try and analyze reports from these distributed intrusion detection systems and other types of network sensors.
133680	142160	With the idea of trying to determine if what you were seeing were correlated events, if this was an initial attack and a follow-up,
142160	149400	or if the two events you were seeing in two different places might be two systems communicating who shouldn't be communicating together.
149400	155300	And to try and use multiple sensors to distribute over large distributed networks to try and do this.
155300	166460	The basic idea behind what I was doing with that was taking target tracking methods that came out of radar target tracking systems,
166460	170820	trying to track real objects in the sky with various radar systems,
170820	177460	and taking that same approach and treating all of our sensors that we have on our network, whether it's an IDS, a firewall, a router,
177460	184400	even a human sat there making observations about what's going on and trying to automate the correlation of that together.
184400	187980	And this wasn't intended to totally throw the human analyst out of the loop,
187980	194700	but just to kind of act as a sort of a first level filtering system to throw away a lot of the information that you don't need
194700	197520	in order to come to a conclusion about what's going on.
198240	203080	With the idea that we were going to kind of move this more towards a point of view,
203080	209580	instead of looking at this one section of the network or this one part of what was going on that's visible to this one sensor,
209580	213560	like, you know, you've got your firewall sat at the, say you've got it sat at the border of your network.
213560	215680	It sees everything that's coming in and out of the border.
215680	218500	But it doesn't see stuff that's entirely internal to the network.
218580	223040	You might have an intrusion detection system sat on one segment of the network that sees what's going on there,
223040	225580	but it doesn't see what's going on on another segment of the network.
225580	228740	And to take all these little pictures, pieces of information,
228740	235080	and to put them together to get a more complete view of what someone was doing while they were attacking the network,
235080	239540	and did this through using radar tracking algorithms,
239540	242900	specifically Bayesian multiple hypothesis tracking,
242900	248280	and making an analogy to the world of computer security,
248280	253640	where our firewalls, our IDS, our humans looking at what's going on on the network,
253640	255860	anything that records information is a sensor.
255860	257480	That's like a radar system.
257480	261860	The actions that the person out there trying to break into the network are doing,
261860	264760	that's the target, and that's the trace they leave behind.
265080	267280	They're trying to put these traces together.
267280	270760	And we're working in a situation where we've got to do this in real time.
270760	272280	We've got incomplete data.
272280	275140	We've got inaccurate data, potentially, about what's going on,
275140	277300	depending on how your sensors are operating.
279020	283800	Just a little bit more about the system.
286120	289820	How this works, this idea of this multiple hypothesis tracking,
289820	292660	is as events occur on the network,
292660	297460	as an event is when a sensor recognizes that something's occurring.
297460	301480	When something actually pops up on the sensor, when it gives a report,
301480	304400	when you've got an IDS that tells you, hey, I think I see something.
304400	307740	When you've got a firewall that decides it's not going to allow this packet
307740	309160	or it sees something unusual.
309160	312480	When you've got your sysadmin on your network saying, hey, you know,
312480	314220	something weird's going on here.
314220	317220	As these events arrive, they're analyzed.
317220	318740	And say, for example, we're sat there,
318740	322520	and one of our systems sees a port scan happening out there.
323040	327020	We build a hypothesis about what we think's going on.
327020	331980	In this case, if we've got a single scan coming in from the outside world,
331980	334260	hey, you know, that's all the information we have.
334260	338240	That's the only hypothesis we can come to, is that that's what's going on.
338240	340300	We're seeing a port scan right now.
340560	344380	Really, I guess, actually, technically, you can make two hypotheses at this point.
344380	347120	You can say, hey, there's a port scan going on,
347120	350880	or alternatively, my IDS isn't working properly,
350880	352580	and this is a false positive.
353580	357720	Then, as other events occur, say you see a buffer overflow attack
357720	359900	against a machine following that.
360140	362400	Well, what could be going on now?
362400	366460	We could make the assumption that the port scan is being followed up
366460	367600	by a buffer overflow.
367600	369500	Someone scanned a machine for a vulnerability,
369500	372320	then they attacked that particular vulnerability on it.
372320	377040	Or, potentially, these could be two unrelated events,
377040	379820	that the port scan could be part of one attack,
379820	382640	the buffer overflow could be part of a different attack.
382660	384220	On the system.
386060	388540	And what we were trying to do with this system
388540	391240	was trying to automate the process of figuring these out.
391240	393700	Now, this is a simple example.
393700	395560	This is a pretty trivial case.
395580	399020	In this particular case, if the port scan is a scan against,
399020	402860	you know, I don't know, against port 80,
402860	408260	and the buffer overflow is a buffer overflow against an IIS server,
408260	410440	chances are those two things are related.
410440	412760	If they're not, if the port scan doesn't match up
412760	415520	with what the buffer overflow was, chances are they're not related.
415520	418040	But, you can extrapolate from this idea
418040	420660	into much more complicated systems,
420660	423180	and much more complicated series of events,
423180	424720	of trying to piece together the pieces
424720	428440	and figure out whether or not all of these events
428440	431100	and all of these things that we see occurring across the network
431100	434560	are related together, are they not related together,
434560	436160	are they likely to be something real,
436160	438180	are they likely to be a false positive
438180	441580	caused by a imperfect sensor,
441580	445080	or imperfect IDS, or firewall, or human in the loop.
446980	448960	Actually, when I was working on this,
448960	451920	one of the most interesting sources of data that I had to work with
451920	455240	came from the Capture the Flag games here at DEF CON.
455240	457920	Luckily, the SHMOO group captures all of that data
457920	460040	that goes on during the Capture the Flag game.
460040	461940	They capture all of that network traffic,
461940	465900	and that provided a great playground to work in,
465900	469540	to try and see if that information could be correlated together.
469540	471340	And this little graph I got up here,
471340	473340	I mean, this is kind of just pulled right out of context.
473340	477120	These are some slides I grabbed just to give a bit of background
477120	480440	about the previous research in this.
481760	485960	Basically, what this was showing is,
485960	491740	as you let the number of hypotheses that you consider increase,
491740	493560	in that previous example I said,
494180	495880	excuse me, I said that we had the two hypotheses
496660	498800	either these two events are unrelated,
498800	503880	or these two events are part of a chain of a single attack.
504180	507180	Well, we let those, we say these are our two hypotheses,
507180	509320	and then we look at the evidence that's going on,
509320	512400	and we evaluate them, and we find out which hypothesis we think
512400	515560	is currently the best one we have available.
515920	519040	Then, we wait for more information to come in.
519040	520640	We'll have a certain confidence level,
520640	523440	and how confident do we believe in this hypothesis?
524060	525880	As more information comes in,
525880	527820	we'll build more hypotheses,
527820	533120	and we re-evaluate the likelihood of our existing hypotheses.
533180	536620	Eventually, at least in theory,
536620	539600	this will eventually converge to a point
539600	544420	where one hypothesis is clearly the winning hypothesis.
544420	546700	Now, the problem with, I said that's in theory,
546700	548360	the problem with that is,
548360	553220	you have to consider every possible hypothesis in order to do that,
553220	555860	and the number of hypotheses grows at a super exponential rate.
555880	558680	So, it's practically impossible to do that.
558680	561160	There's a lot of work on the pruning of them,
561160	562280	deciding which ones you want to keep,
562280	563840	which ones you want to throw away.
563980	566980	And what this graph is just showing here was,
566980	568720	along the bottom is a number of hypotheses
568720	570820	that were allowed to remain in the system,
570820	573500	going from, well, at the bottom one,
573500	575240	all the way up to a thousand,
575240	577620	and the accuracy of how well it correlated
577620	579980	the different attacks together.
580020	582280	And it never quite got up to 100%,
582280	587540	but it got up into about 93, 94% accuracy
587540	589140	on the capture-the-flag data,
589140	593320	being able to piece together what were related attacks.
593320	595820	And now, of course, this was actually correlated
595820	600080	against the baseline was done by hand,
600080	602880	taking me, I and a few others that helped me,
602880	606340	took the data over the capture-the-flag game
606340	610100	over about a, I think it was about an eight-hour period,
610100	613160	and by hand figured out what was related information,
613160	614420	what were related attacks,
614420	616620	and then built a system that could do,
616620	618840	to automate that process.
618840	621280	So this thing, it worked.
621280	623880	This was a, it was a pretty decent idea.
623880	624720	It worked.
624720	628400	It didn't necessarily work as well as we had hoped initially.
629760	632200	If you've got everything on a same network,
632200	633180	or related network,
633180	635720	where you're likely to see lots of related events,
635720	636940	it works well.
636940	639260	If you've got this distributed over large networks,
639260	642640	where you're likely to see many more unrelated events
642640	646400	than related events, it goes, the accuracy goes down a bit.
646400	648000	Or at least the amount of work you have to do
648000	650300	to get good accuracy goes way up.
650300	651420	It's more accurate.
651420	653080	It's more accurate to say.
654340	657200	So that's what it had done in the past.
657480	660700	And this got me thinking about,
660700	662860	so this was a system that had developed
662860	667060	to try and detect related information on a network.
667140	669140	And then, of course, you know, once you can do that,
669140	670440	you always think about the next step.
670440	673080	And once the next step, once you can detect something,
673080	675340	you figure out how to hide it even better.
675660	676060	Right?
676060	678620	You know, it's always kind of that one-upmanship game
678620	679480	that we're playing.
679480	682860	So it got me thinking, how do we defeat a system
682860	684000	that works like that?
684000	686800	How could you avoid detection on a network
686800	689980	that was well-observed, well-monitored,
689980	692740	and where the information was well-correlated,
692740	696500	where you couldn't rely on the guy sat over on this part
696500	698920	of the network not knowing what the guy sat over
698920	700880	on this other part of the network was doing,
700880	703340	or seeing, or knew about what was going on?
703340	706260	If you assume that there was complete coverage of the network,
706260	709360	how could you hide what was going on on there?
709360	713260	And I'm not necessarily, I'm not talking about so much the detection
713260	717480	of a specific attack, like someone does a buffer overflow
717480	719280	against a web server.
719280	722920	They do, you know, whatever other type of initial attack
722920	724460	to gain access to the system.
724460	726280	But assuming they're already on there.
726280	728320	They've got onto the system, and they want
729080	730700	to be communicating back and forth.
730700	734480	They've got their remote machine they're sat at.
734480	736480	They've got access to a machine on the network.
736480	738040	They want to communicate back and forth,
738040	740200	but they don't want to be detected while doing it.
740200	743640	How could you go about that and avoid detection
743640	745860	on a well-monitored network?
747900	750100	So you have to look at this from the point of view
750100	752780	of where do we have the choices about what we do?
753020	755280	When you're talking about the initial attack,
755280	757160	you don't have a whole lot of choices.
757160	759780	If you've got a, you know, I guess, I mean, I guess,
759780	761480	unless you get lucky and you see a system out there
761480	763280	that's got a ton of vulnerabilities on it,
763280	764700	then you've got some choices about what to do.
764700	767420	But assume that you have limited choices
767420	769160	of how a system is broken into.
769160	771740	There's limited ways into the system to begin with.
771740	773460	You don't have many choices there.
773820	779840	So any tool that's written to initially gain access
779840	782840	to a system usually has a fairly limited lifespan.
782980	787140	At least it's limited lifespan in the range
787160	789280	of people who actually care about security.
789280	792820	You always find some bozo out there who never updates anything,
792820	794520	never puts any security on their system.
794520	795840	You can always get into them.
795840	798140	But talking about the people who are serious about it,
798140	800080	you have a limited lifespan with any sort of tool
800080	801800	for initially getting in there.
802760	804660	However, once you have access to a machine
804660	806520	and all you're worried about doing is communicating
806520	809840	with that machine, you've got a lot of choices.
809840	812680	You know, we're not stuck with one type of communication protocol.
812680	815740	We're not stuck with any traditional communication protocol
815740	817120	that's out there whatsoever.
818740	822160	The trick to this is figuring out which ones work
822160	825180	and which ones won't be seen.
829080	830960	So here's the question.
830960	832340	How do you communicate on a network
832340	834700	without letting anyone know you're doing it?
835160	836680	First things first.
837860	840180	How do they detect what's going on?
840180	843260	How does someone see what you're doing on a network?
843260	844280	You've got IDS.
844280	845040	You've got firewalls.
845040	846260	You've got observers.
849300	850680	What's going on on the network?
852320	856400	In general, I pick the IDS and I say software or human
856400	858840	because whatever's looking at your network,
858840	860880	whether it's automated or whether it's a person,
860880	861780	they're trying to determine
861780	863720	if someone's intruding on your network.
864200	865760	You get two basic forms of this.
865760	867300	And this applies...
868020	871420	I think the IDS system, in at least one sense,
871420	872780	is the most general case.
872780	875040	And you can kind of find derivative cases
875040	878460	that cover the same concept for firewalls and routers
878460	879800	and everything else out there.
879800	882200	There's basically two forms of detection out there.
882300	884160	Anomaly and signature detection.
884360	887980	Signature detection works on known attacks, known events.
888000	890340	You know, if you know exactly what you're looking for,
890340	893000	you know when you see this packet go by, it's something bad,
893000	894780	you want to throw up an alert about it.
894780	896920	Hey, that's great, you can catch it every time.
896920	898400	It'll never get by.
898400	900320	You know, you've got that one nailed.
900860	903500	The only way to avoid that type of detection is
903500	905360	to use either an unknown method
905360	908360	or something perhaps that changes constantly,
908360	910360	and never use the same method twice.
911840	915640	The anomaly detection, it doesn't detect misuse of the system.
915640	917140	It doesn't detect something malicious.
917140	919160	It just detects something unusual.
919560	925880	So it's not necessarily really great at trying to pick
925880	928080	up something bad happening on your network,
928080	929920	but it'll pick up something unusual.
930320	933240	And it's really, if the signature detection doesn't work,
933240	934560	that's the only chance you have left,
934560	936340	is looking for something unusual.
936340	937680	If you don't know what to look for,
938360	939780	look for things that stand out.
941480	944840	So we can't really avoid the signature detection.
944840	946640	If you've got a way of communicating,
946640	948180	or a way of doing anything on the network,
948180	951480	and someone can write a signature to detect that, that's it.
951480	953380	You can't do anything with it.
953380	954800	It's got a limited lifespan.
954900	956800	Eventually it's going to be seen.
958580	963780	So the only alternative is to use something that you can't write
963920	968340	a signature for, something that changes constantly,
968340	971380	quote-unquote random, or at least appears random
971380	973860	to anything that's observing the network.
974200	978260	And we have to be able to do this without looking unusual.
978260	979040	And that's the key.
979040	980620	Not only do we have to do something,
980620	982920	it's kind of a catch-22 in a way,
982920	985620	because we've got to do something that's very unusual,
985620	988980	you know, this kind of random changing communication protocol,
988980	991200	but we've got to do it without looking unusual.
991200	993900	You can't stand out on there.
993900	998320	So the first stage of this is to detect the baseline of the network.
998340	1003020	What does the traffic on the network look like to begin with?
1003020	1005720	What is occurring on the network?
1005720	1008340	What happens out there all the time?
1008340	1010000	And this can be done passively.
1010000	1012980	You can sit back and discover what type of traffic is allowed
1012980	1016140	on the network, what does normal traffic look like,
1016140	1020240	and kind of build yourself a map of both what is going on
1020240	1022860	on the network, what the structure of the network is,
1022860	1026040	and what's allowed in and out of this network.
1027480	1029260	This is not a new concept.
1029480	1031500	It's just this general idea of doing this.
1031500	1032560	This is done all the time.
1032560	1038380	This is how many tools and other fun little things are written
1038380	1039320	and developed.
1039340	1044080	But the key thing is that this is what, generally,
1044080	1047440	this is what people do this process.
1047500	1049800	Someone looks at a network or you think
1049800	1051620	about what's going on on the network.
1051980	1054500	You know, a good example of this is a reverse WWW shell.
1054500	1055940	That's an old tool.
1056040	1060380	The idea of this was that you've got a computer inside the network.
1061160	1064140	You're not allowed to make connections from the outside to it.
1064140	1068100	You know, the firewall is going to drop any inbound connections to it.
1068100	1070640	So you put a piece of software on that computer inside the network
1070640	1074440	that at certain intervals, perhaps at random intervals,
1074440	1076780	it looks like it's going out to a web browser.
1076780	1078420	It goes and makes a web request.
1078420	1082560	Except that what that web request is doing is coming to your computer
1082560	1087280	on the outside, getting the next command that you've told it to do.
1087280	1093000	It carries it back as the HTTP response to the target computer,
1093000	1095240	to the one that you got access to,
1095240	1097440	and then it carries out that particular command.
1097440	1099800	It's masqueraded looking like the computer
1099800	1101640	on the inside is just surfing the web.
1102180	1105460	That's a great way of hiding it, unless someone knows to look for it.
1105460	1108100	Once someone knows to look for it, if you stick with it too long,
1108100	1109560	they're going to look for it, they're going to see it,
1109560	1110800	it's going to stand out.
1111520	1116100	Similarly, carrying data commands and ICMP echo response packets,
1116100	1118280	same sort of idea.
1118400	1123480	What I'm trying to do with this project is to automate this process
1123480	1128180	and make it run on the fly and have it adapt itself
1128180	1131460	to whatever network it's currently working on.
1131460	1135400	Look at what's going on on the network, decide what to do on the network,
1135400	1138680	decide what will work there, and then carry it out.
1142900	1146500	Some aspects of network traffic are going to have a low entropy,
1146500	1147980	meaning a very low randomness.
1147980	1152780	They're going to be very kind of, the same thing is always going to happen.
1153520	1156500	Certain communication protocols are only going to go to certain computers.
1156580	1159100	DNS requests are only going to go to your DNS servers.
1159100	1161560	They're not going to be jumping around to every computer on your network.
1162180	1165000	Incoming web requests are probably only going to come to your web server.
1165000	1166960	They're not going to come to every computer on your network.
1167300	1168660	Other things are going to look like this.
1168680	1170320	They're going to be much more random.
1170320	1174940	Maybe outgoing web requests, you know, people, different people circling the web.
1175280	1177820	Outgoing FTP, all sorts of things.
1177820	1179620	Other things are going to be very random.
1179620	1182100	There's going to be a lot more entropy in that.
1182580	1186700	And entropy is the key to hiding information.
1187040	1190280	The more entropy you have on the system,
1190280	1194020	the more information you can hide in that.
1194020	1198660	This is like if you look at, if you look at a system
1198680	1200860	like a steganography, for example, you know,
1200860	1203380	you're trying to hide information in something else.
1203380	1206320	If you've got a bitmap, a bitmap has lots and lots
1206320	1210240	of redundant information in it versus a JPEG image.
1210240	1212920	A JPEG has taken a lot of that redundant information out.
1212920	1215040	That's why a JPEG is smaller than a bitmap.
1215120	1218620	You can hide a lot more information in a bitmap than you can in a JPEG.
1218620	1221560	Higher entropy, you can hide more information inside it.
1221620	1226360	So if we find what has the highest entropy on that network,
1226360	1230120	what communication channels have the highest degree of randomness,
1230120	1232360	we can then pick what we want to work in.
1232360	1236280	And we've got all sorts of, all sorts of things that we can work with here.
1236280	1239360	We can work with the timing of the packets, we can work with packets,
1239360	1243380	sending out packets that have bad checksums, malformed checksums,
1243380	1245120	all sorts of different things that we can play with.
1245120	1249540	We don't have to use a SSH or Telnet or some other standard type
1249540	1251400	of communication format.
1251400	1255980	We can send crafted packets where the information is carried in all sorts
1256360	1259340	of different little pieces of information inside that packet.
1259340	1262740	The key is, we just have to make sure it doesn't look unusual
1262740	1264720	when that packet goes out.
1265120	1269120	So the overall concept here is we detect what the network baseline
1269120	1270080	condition is.
1270080	1274280	On the specific network that we're looking at, what does normal look like?
1274280	1276140	What doesn't look unusual?
1276240	1280240	And then select from that the potential communication channels.
1280240	1284920	Determine which ones have highly random information on the network.
1284940	1286340	Prune it down.
1287300	1289160	Initially, we can select from anything.
1289160	1291720	We can craft a packet that does anything we want.
1291780	1295020	We're going to look at what happens on the network, figure out what's allowed,
1295020	1299940	limit it to that, and then limit it to what has a lot of entropy within that.
1300020	1303700	And then we have to somehow communicate this method to the receiver on the outside.
1303700	1308320	We have to get the information of what communication scheme we're going to use.
1308320	1312580	We have to get that to the receiver outside and then maintain a, you know,
1312580	1315140	I put almost undetectable presence on the network.
1315140	1317240	You never should think you're undetectable.
1317240	1319460	You should never think anything's absolute because it never is.
1319460	1321340	That's how you always get yourself into trouble.
1321600	1325900	But we can monitor and update the network conditions to stay hidden.
1325900	1327480	If the network conditions change,
1327480	1329760	we can change the scheme we're using to communicate.
1331580	1335240	On the network, if we just sit there and listen, what can we learn
1335240	1336680	by listening on the network?
1336680	1340960	There's all sorts of things that we can find out by just sitting there
1340960	1344860	and listening, not doing anything active, not doing anything to be discovered.
1344860	1347920	We can figure out what types of packets are allowed inside the network,
1347920	1350180	what types of packets are allowed outside the network.
1350180	1352360	We can figure out the architecture of the network.
1352380	1353260	Where are the switches?
1353260	1354360	Where are the routers?
1354360	1356720	Where are other machines on this network?
1356920	1359920	And then look at what types of packets are flying around.
1359920	1363260	What types of packets does the machine that I'm on send and receive?
1363260	1366280	What types of packets do other machines out there send and receive?
1366280	1371720	And from this, get an idea of what is allowed to move around this network,
1371720	1376600	what is moving around this network, and what we can inject into the data flowing
1376600	1380700	around without being, without sticking out like a sore thumb
1380700	1382900	and being immediately identified.
1384120	1387780	So if we narrow down these choices, we start with the ability to send any type of packet,
1387780	1389640	you know, send it to any port whatsoever.
1390220	1392640	We start paring it down based on what's available,
1392640	1394520	figure out what has the highest entropy.
1395240	1398920	Look at this, look at the type of packets based
1398920	1401480	on the protocol the ports are using.
1402180	1406480	And look at the entropy based on how often do these packets fly?
1406480	1409800	How different is the data in these packets whenever they go by?
1409800	1412600	What different machines do these types of packets go to?
1412600	1416940	And then pick a channel that we know we can get from point A to point B.
1416940	1420560	We can get from inside the network we've got access to the machine on,
1420560	1424460	out of that network over to the place where we want to get the information to,
1424460	1426840	or back and forth, vice versa, either way.
1426840	1431080	We can figure out what can get into one, out of one network, into another,
1431080	1432420	and then back the other way.
1432420	1435200	It doesn't necessarily have to be a symmetric communication channel.
1435300	1439420	The packets that you send out, the packets that you send going out one way,
1439420	1442560	don't have to look a heck of a lot like the packets coming back in the other way.
1442560	1445880	As long as they're getting to the right segment on the network,
1445880	1448580	as long as they're getting down to the right branch off of your switch
1448940	1454900	so that it can be picked up by a, by a network card in promiscuous mode,
1454900	1458980	as long as you can get down that far and you know what to look for,
1458980	1461060	each guy on each end knows what to look for,
1461080	1464300	you don't have to have it even be a symmetric communication channel between them.
1464300	1468360	You can have essentially two different channels going back and forth.
1470320	1476700	One of the big challenges with this system is starting the conversation.
1476860	1479980	If you've got a piece of software running on the inside of this network,
1479980	1482560	and it's going to start communicating with you on the outside,
1482560	1487040	and you don't know what particular communication scheme it's going to be using,
1487040	1490520	there's some difficulties in getting, in getting that first packet out of there,
1490520	1493180	that first piece of information to the outside,
1493180	1497020	without having it be something that can easily be written as a signature.
1497020	1502160	Because it's hard to, it's hard to change things or inject randomness
1502560	1505020	into the first bit of communication.
1505020	1513220	There's some, there's some ways that we can limit how signature vulnerable that first bit
1513220	1518320	of communication is, but that's one of, that is, that's one of the points that needs,
1518320	1520500	that presents some challenge and needs some work on in this.
1521680	1524520	Having the communication software itself remain undetected
1524520	1526940	on the remote machine, not talking about what the software is doing,
1526940	1529800	but actually having the software itself avoid detection.
1529800	1533380	Of course, that's another challenge, but that's a completely different story.
1534200	1540300	That's, whether it's something that's using a polymorphic code that is,
1540300	1542500	that changes from one installation to another,
1542500	1544680	or even changes itself constantly.
1544680	1546720	There are ways around that, but it is a different,
1546720	1549320	but it is another challenge in there.
1549320	1552740	The third one that's actually, I think, a fairly interesting one,
1552740	1555160	is the problem on a low entropy network.
1555160	1556700	What do you do when there's not a whole lot
1556700	1558760	of randomness going on on the network?
1559200	1561660	You know, if there's not a lot of randomness in the packets,
1561660	1563320	how do we stay hidden in it?
1563320	1565540	We have to ensure that every packet that we send
1565540	1571820	out doesn't significantly affect the statistical baseline of the network,
1571820	1573980	so that an anomaly detection system sat
1573980	1579300	on the network will not recognize this as something unusual.
1579320	1580880	It will not stand out.
1580880	1585580	It won't push the statistical analysis of the network beyond the limits,
1585580	1587660	beyond the thresholds that we currently have,
1587660	1589400	and it will avoid becoming an anomaly.
1589400	1594880	This is actually the area right now that I'm doing, that I'm concentrating on,
1594880	1601420	trying to figure out the best methods for communicating and picking channels
1601420	1606440	and picking well-hidden channels on a low entropy network.
1606440	1612240	So, just as a summary in the system, you know, what's real, what's not real.
1612480	1616280	So far, the allowed protocols discovery,
1616280	1618160	the network architecture discovery,
1618160	1621440	the statistical profiling of the network,
1621440	1628040	those are working prototypes, those modules,
1628040	1630200	those parts of the system are working prototypes.
1630200	1632400	Next stages that we're moving towards are the selection
1632400	1635620	of the communication scheme, implementation of the communication,
1635620	1641020	and the adaptation to changing network conditions.
1641400	1646880	I hope that by this time next year, this will actually be a working package
1646880	1649860	that I can give maybe a bit better presentation and demonstration
1649860	1651540	of what it's actually doing.
1651540	1653340	But this is the current idea.
1653460	1657340	Anybody that has any interest in this or any ideas or feedback
1657340	1660860	or wants to tell me why I'm crazy for thinking this, feel free.
1660860	1662700	There's my contact information.
1663440	1667460	And that's it for about a 25-minute presentation.
1674470	1675910	There's one question.
1685550	1687810	That is a great question.
1688230	1691050	I'll take that just, I'll try and answer one more real quick.
1691050	1693550	He asked, is there any concept of trying
1693550	1695950	to actually change the baseline of the network
1695950	1698930	so that you can do something that used to look unusual,
1698930	1701110	make it not look unusual anymore?
1701130	1704890	That is, it's not one of the first level items on there.
1704890	1707270	That's a pretty advanced way of working it.
1707270	1710970	But actually changing, injecting stuff in slow enough that the system,
1710970	1714050	the anomaly detection system adapts to it and thinks that's normal,
1714050	1718030	that is one of the long-term ideas on there.
1718030	1721490	That's a great idea to put into this.
1759870	1761050	Thank you.