start	end	text
6940	13760	So, anyways, I'm Dan Burrows, just a little bit about myself.
13760	16440	I'm a professor at the University of Central Florida
16440	19200	in the Engineering Technology Department.
19200	23500	Specifically, I work in the Information Systems Technology Program,
23500	27720	which is a, it's a very applied approach to engineering
27720	32260	and specifically information technology systems.
32260	34360	We're currently at the University of Central Florida,
34380	40260	developing a undergraduate security program that I'm also,
40260	43040	I'm the one that's mainly involved in developing that.
43040	46640	And that's actually what my second talk a little bit later is on today.
46660	51420	But this is the more, maybe more interesting, more technical one.
51640	54500	My past research includes the correlation
54500	59780	of distributed network sensors.
59780	64240	If you have a, if you have a large scale network, you have intrusion
64240	68140	detection systems, you have firewalls, you have other things
68140	70780	that are recording information saying what's going on on the network,
70780	74560	trying to correlate that information together to bring it all together
74560	76960	and trying to see the big picture of what's going on,
76960	80660	rather than getting these little kind of half views
80660	83020	of what's really occurring out on the network.
83020	87360	And also I'm working on some projects that involve combined data sharing
87360	91100	networks for law enforcement in the state of Florida.
92540	96440	You know, this little blurb ad about the University of Central Florida,
96440	97480	it's down in Orlando, Florida.
97480	99900	It's about, we've got about 42,000 students there,
99900	102240	about 5,500 of which are in engineering.
102280	106740	We're located about 13 miles east of Orlando, Florida.
108480	111680	As I said, the Information System Technology Program,
111680	114740	this is a really, it's an applied engineering degree.
114740	118620	It's very hands on, very real world, very current tools,
118620	122620	not so much the traditional theoretical approach to engineering.
123700	127220	Heavy concentration on hands on learning in the program.
128320	136500	A little bit about the background of what led me to this current idea is,
136500	139040	there was a previous research that I worked on.
139040	142640	I gave a couple of presentations back at DEF CON 9 and 10,
142640	147180	and this was on using Bayesian multiple hypothesis to try
147180	150500	and analyze reports from these distributed intrusion detection systems
150500	153920	and other types of network sensors, with the idea of trying to determine
153920	157200	if what you were seeing were correlated events,
157200	160800	if this was an initial attack and a follow-up,
160800	162760	or if the two events you were seeing
162760	166020	in two different places might be two systems communicating
166020	168100	who shouldn't be communicating together.
168100	170480	And to try and use multiple sensors to distribute
170480	174040	over large distributed networks to try and do this.
174040	179980	The basic idea behind what I was doing with that was taking target tracking methods
179980	185120	that came out of, actually out of radar target tracking systems,
185120	189540	trying to track real objects in the sky with various radar systems,
189540	192600	and taking that same approach and treating all of our sensors
192600	196160	that we have on our network, whether it's an IDS, a firewall, a router,
196160	200300	even a human, sat there making observations about what's going on,
200300	203040	and trying to automate the correlation of that together.
203040	206600	And this wasn't intended to totally throw the human analyst out of the loop,
206600	209720	but just to kind of act as a sort of a first level filtering system
209720	214020	to throw away a lot of the information that you don't need in order
214020	218020	to come to a conclusion about what's going on, with the idea
218020	221960	that we were going to kind of move this more towards a point of view.
221960	225480	Instead of looking at this one section of the network or this one part
225480	228340	of what was going on that's visible to this one sensor.
228340	231200	Like, you know, you've got your firewall sat at the, say you've got it sat
231200	232260	at the border of your network.
232260	233020	It sees everything that's going on.
233040	234480	It sees everything that's coming in and out of the border.
234480	237240	But it doesn't see stuff that's entirely internal to the network.
237320	240060	You might have an intrusion detection system sat on one segment
240060	241780	of the network that sees what's going on there,
241780	244400	but it doesn't see what's going on on another segment of the network.
244400	247480	And to take all these little pictures, pieces of information,
247480	249780	and to put them together to get a more complete view
249780	253820	of what someone was doing while they were attacking the network.
253840	258240	And did this through using radar tracking algorithms,
258240	261440	specifically Bayesian multiple hypothesis tracking.
262740	266820	And making an analogy to the world of computer security
266820	271080	where our firewalls, our IDS, our humans looking at what's going
271080	274580	on on the network, anything that records information is a sensor.
274580	276100	That's like a radar system.
276180	279300	The actions that the person out there trying to break
279300	281820	into the network are doing, that's the target.
281820	283480	And that's the trace they leave behind.
283480	285880	And we're trying to put these traces together.
285980	289400	And we're working in a situation where we've got to do this in real time.
289400	290920	We've got incomplete data.
290920	293840	We've got inaccurate data, potentially, about what's going on,
293840	296100	depending on how your sensors are operating.
297620	302600	Just a little bit more about the system.
303320	308300	The idea, how this works, this idea of this multiple hypothesis tracking is
308920	312760	as events occur on the network, as an event is
312760	316080	when a sensor recognizes that something's occurring.
316080	320160	When something actually pops up on the sensor, when it gives a report,
320160	323080	when you've got an IDS that tells you, hey, I think I see something,
323080	326440	when you've got a firewall that decides it's not going to allow this packet
326440	329300	or it sees something unusual, when you've got your sysadmin
329300	332880	on your network saying, hey, you know, something weird's going on here.
332880	335940	As these events arrive, they're analyzed.
335940	338260	And say, for example, we're sat there and one
338260	341500	of our systems sees a port scan happening out there.
341780	345720	We build a hypothesis about what we think's going on.
345720	350140	In this case, if we've got a single scan coming in from the outside world,
350160	352960	hey, you know, that's all the information we have.
352960	356960	That's the only hypothesis we can come to is that that's what's going on.
356960	358960	We're seeing a port scan right now.
359260	362100	Really, I guess, actually, technically, you can make two hypotheses
362100	363060	at this point.
363060	367580	You can say, hey, there's a port scan going on, or alternatively,
367580	371200	my IDS isn't working properly, and this is a false positive.
372560	376420	Then, as other events occur, say you see a buffer overflow attack
376420	378500	against a machine following that.
378500	381080	Well, what could be going on now?
381080	384880	We could make the assumption that the port scan is being followed
384880	386280	up by a buffer overflow.
386280	388900	Someone scanned a machine for a vulnerability, then they attacked
388900	390960	that particular vulnerability on it.
390960	395700	Or, potentially, these could be two unrelated events,
395700	398500	that the port scan could be part of one attack,
398500	403000	the buffer overflow could be part of a different attack on the system.
404640	407720	And what we were trying to do with this system was trying
407720	409940	to automate the process of figuring these out.
409940	412400	Now, this is a simple example.
412400	414280	This is a pretty trivial case.
414360	419040	In this particular case, if the port scan is a scan against, I don't know,
419040	424140	against port 80, and the buffer overflow is a buffer overflow
424140	429200	against an IIS server, chances are those two things are related.
429200	432660	If the port scan doesn't match up with what the buffer overflow was,
432660	434240	chances are they're not related.
434240	438980	But, you can extrapolate from this idea into much more complicated systems
438980	443420	and much more complicated series of events, of trying to piece together the pieces
443420	448000	and figure out whether or not all of these events and all of these things
448000	451660	that we see occurring across the network are related together,
451660	454880	are they not related together, are they likely to be something real,
454880	460220	are they likely to be a false positive caused by a imperfect sensor,
460220	463800	imperfect IDS, or firewall, or human in the loop.
465720	469500	Actually, when I was working on this, one of the most interesting sources of data
469500	473920	that I had to work with came from the Capture the Flag games here at DEF CON.
473920	477340	Luckily, the SHMOO group captures all of that data that goes
477340	478740	on during the Capture the Flag game.
478740	480540	They capture all of that network traffic.
480820	485800	And that provided a great playground to work in, to try and see if
485800	488200	that information could be correlated together.
488240	490620	And this little graph I got up here, I mean, this is kind
490620	492040	of just pulled right out of context.
492040	495840	These are some slides I grabbed just to give a bit of background
495840	499240	about the previous research in this.
500400	506460	Basically, what this was showing is, as you let the number of hypotheses
507100	514180	that you consider increase, in that previous example, I said that we had
514180	517540	the two hypotheses, either these two events are unrelated,
517540	522020	or these two events are part of a chain of a single attack.
522680	525860	Well, we let those, we say, these are our two hypotheses.
525860	529240	And then we look at the evidence that's going on, and we evaluate them,
529240	534220	and we find out which hypotheses we think is currently the best one we have available.
534640	537740	Then, we wait for more information to come in.
537740	540700	We'll have a certain confidence level, and how confident do we believe
540700	542060	in this hypothesis?
542760	546540	As more information comes in, we'll build more hypotheses,
546540	551760	and we re-evaluate the likelihood of our existing hypotheses.
551760	558300	Eventually, at least in theory, this will eventually converge to a point
558300	563020	where one hypothesis is clearly the winning hypothesis.
563120	566880	Now, the problem with it, I said that's in theory, the problem with that is,
566880	571880	you have to consider every possible hypothesis in order to do that,
571880	574940	and the number of hypotheses grows at a super-exponential rate.
574940	577340	So, it's practically impossible to do that.
577340	580700	There's a lot of work on the pruning of them, deciding which ones you want
580700	582580	to keep, which ones you want to throw away.
582700	586780	And what this graph is just showing here was, along the bottom is a number
586780	591320	of hypotheses that were allowed to remain in the system, going from, well,
591320	594920	at the bottom one, all the way up to 1,000, and the accuracy
594920	598820	of how well it correlated the different attacks together.
598820	604400	And it never quite got up to 100%, but it got up into about 93,
604400	610680	94% accuracy on the capture-the-flag data, being able to piece together what we're seeing
610700	612040	and what were related attacks.
612040	615860	And now, of course, this was actually correlated against the baseline,
615860	621600	was done by hand, taking, we, I, and a few others that helped me,
621600	627020	took the data over the capture-the-flag game over about a,
627020	629820	I think it was about an eight-hour period, and by hand,
629820	633080	figured out what was related information, what were related attacks,
633080	637460	and then built a system that could do to automate that process.
637560	640060	So, this thing, it worked.
640060	642540	This is a, it was a pretty decent idea.
642540	643420	It worked.
643420	647020	It didn't necessarily work as well as we had hoped, initially.
648500	651880	If you've got everything on a same network or related network,
651880	655620	where you're likely to see lots of related events, it works well.
655660	658580	If you've got this distributed over large networks, where you're likely
658580	663200	to see many more unrelated events than related events,
663200	666460	it goes, the accuracy goes down a bit, or at least the amount of work you have
666460	670040	to do to get good accuracy goes way up, is more accurate.
672440	675840	So, that's what it had done in the past.
676240	681580	And this got me thinking about, so, this was a system that had developed
681580	685800	to try and detect related information on a network.
685840	687840	And then, of course, you know, once you can do that,
687840	689120	you always think about the next step.
689120	692540	And once the next step, once you can detect something, you figure out how
692540	694680	to hide it even better, right?
694680	698180	You know, it's always kind of that one-upmanship game that we're playing.
698180	702780	So, it got me thinking, how do we defeat a system that works like that?
702780	707420	How could you avoid detection on a network that was well-observed,
707420	711480	well-monitored, and where the information was well-correlated,
711480	717420	where you couldn't rely on the guy sat over on this part of the network not knowing what the guy sat
717420	720400	over on this other part of the network was doing, or seeing,
720400	722060	or knew about what was going on.
722060	724940	If you assume that there was complete coverage of the network,
724940	728060	how could you hide what was going on on there?
728060	732020	And I'm not necessarily, I'm not talking about so much the detection
732020	737960	of a specific attack, like someone does a buffer overflow against a web server,
737960	743120	they do, you know, whatever other type of initial attack to gain access to the system.
743120	747020	But assuming they're already on there, they've got on to the system and they want
747020	749360	to keep communicating back and forth.
749360	753140	They've got their remote machine they're sat at.
753140	755140	They've got access to a machine on the network.
755140	758040	They want to communicate back and forth, but they don't want to be detected while they're on the network.
759760	764540	How could you go about that and avoid detection on a well-monitored network?
766460	768800	So, you have to look at this from the point of view
768800	771460	of where do we have the choices about what we do?
771700	775840	When you're talking about the initial attack, you don't have a whole lot of choices.
776040	779200	If you've got a, you know, I guess, I mean, I guess, unless you get lucky
779200	782000	and you see a system out there that's got a ton of vulnerabilities on it,
782000	783400	then you've got some choice about what to do.
783400	787880	But assume that you have limited choices of how a system is broken into.
787880	790480	There's limited ways into the system to begin with.
790480	792300	You don't have many choices there.
792640	798520	So, any tool that's written to, to initially gain access
798520	801680	to a system usually has a fairly limited life span.
801680	806440	At least it's limited, limited life span in the realm of people
806440	807980	who actually care about security.
807980	811500	You always find some bozo out there who never updates anything,
811500	813220	never puts any security on their system.
813220	814540	You can always get into them.
814540	817860	But talking about the people who are serious about it, you have a limited life span.
817880	820540	With any sort of tool for initially getting in there.
821460	824120	However, once you have access to a machine and all you're worried
824120	828560	about doing is communicating with that machine, you've got a lot of choices.
828680	831400	You know, we're not stuck with one type of communication protocol.
831400	834720	We're not stuck with any traditional communication protocol that's
834720	836080	out there whatsoever.
837540	843800	The trick to this is figuring out which ones work and which ones won't be seen.
847960	849740	So, here's, here's the question.
849740	853320	How do you communicate on a network without letting anyone know you're doing it?
853820	855280	First thing's first.
856620	858860	How do they detect what's going on?
858860	861960	How does someone see what you're doing on a network?
861980	864880	You've got IDS, you've got firewalls, you've got observers.
864920	869320	All of these things are sat there looking at what's going on on the network.
870980	876080	In general, I pick the IDS and I say software human because, you know,
876080	879640	whatever's looking at your network, whether it's automated or whether it's a person,
879640	882440	they're trying to determine if someone's intruding on your network.
882980	884420	You get two basic forms of this.
884420	890480	And this, this applies, um, I think the IDS system in at least one sense is the most
890480	895100	general case and you can kind of, uh, find derivative cases that cover this,
895100	898500	the same concept for firewalls and routers and everything else out there.
898500	900920	There's basically two forms of detection out there.
901000	902860	Anomaly and signature detection.
903060	906620	Signature detection works on known attacks, known events.
906620	909620	You know, if you, if you know exactly what you're looking for, you know,
909620	913460	you see this packet go by, it's something bad, you want to throw up an alert about it.
913460	917100	Hey, that's great, you can catch it every time, it'll never get by,
917100	919000	you know, you've got that one nailed.
919500	924060	The only way to avoid that type of detection is to use either an unknown method
924060	929020	or something perhaps that changes constantly, never use the same method twice.
930580	934300	The anomaly detection, it doesn't detect misuse of the system,
934300	937800	it doesn't detect something malicious, it just detects something unusual.
937800	944580	So, it's, it's not necessarily really great at trying to pick
944580	946660	up something bad happening on your network,
946660	948580	but it'll pick up something unusual.
948820	951960	And it's really, if the signature detection doesn't work,
951960	955040	that's the only chance you have left, is looking for something unusual.
955040	958420	If you don't know what to look for, you've got to look for things that stand out.
959500	963500	So, we can't really avoid the signature detection.
963500	966780	If you've got a way of communicating or a way of doing anything on the network
966780	970160	and someone can write a signature to detect that, that's it.
970160	972080	You can't, you can't do anything with it.
972080	975580	It's got a limited lifespan, eventually it's going to be seen.
977200	983620	So, the only alternative is to use something that you can't write a signature for,
983620	988720	something that changes constantly, something that is quote unquote random,
988720	992600	or at least appears random to anything that's observing the network.
992720	996760	And we have to be able to do this without looking unusual.
996780	997760	And that's the key.
997760	1001620	Not only do we have to do something, it's kind of a catch-22 in a way,
1001620	1004640	because we've got to do something that's very unusual, you know,
1004640	1007640	this kind of random changing communication protocol,
1007640	1009880	but we've got to do it without looking unusual.
1009880	1012580	You can't stand out on there.
1012580	1017280	So, the first stage of this is to detect the baseline of the network.
1017480	1021640	What does the traffic on the network look like to begin with?
1021640	1024420	What does, what is occurring on the network?
1024420	1026760	What happens out there all the time?
1026780	1028700	And this can be done passively.
1028700	1031680	You can sit back and discover what type of traffic is allowed
1031680	1034860	on the network, what does normal traffic look like,
1034860	1039880	and kind of build yourself a map of both what is going on on the network,
1039880	1041580	what the structure of the network is,
1041580	1044660	and what's allowed in and out of this network.
1046140	1048000	This is not a new concept.
1048180	1050160	This just, this general idea of doing this.
1050160	1051240	This is done all the time.
1051240	1056760	This is how many tools and, and other fun little things are used.
1056780	1058020	They're written and developed.
1058040	1062780	But the key thing is, is that this is what, generally,
1062780	1066140	this is what people, people do this process.
1066200	1070380	Someone looks at a network or you think about what's going on on the network.
1070640	1073200	You know, a good example of this is a reverse WWW shell.
1073200	1074740	That's an old tool.
1074740	1079060	The idea of this was that you've got a computer inside the network.
1079660	1082780	It's, you're not allowed to make connections from the outside to it.
1082780	1084960	You know, the firewall's gonna drop any connection,
1084960	1086720	inbound connections to it.
1086780	1089780	So you put a piece of software on that computer inside the network.
1089860	1093280	That, at certain intervals, perhaps at random intervals,
1093280	1095480	it looks like it's going out to a web browser.
1095480	1097100	It goes, makes a web request.
1097100	1101260	Except that, what that web request is doing is coming to your computer
1101260	1105960	on the outside, getting the next command that you've told, told it to do.
1105960	1111680	It carries it back as the HTTP response to the, to the target computer,
1111680	1113900	to the one that, the one that you got access to.
1113900	1116160	And then it carries out that particular command.
1116160	1116760	It's masquerade.
1116780	1120400	It's masqueraded looking like the, the computer on the inside is just surfing the web.
1120840	1124160	That's a great way of hiding it, unless someone knows to look for it.
1124160	1126620	Once someone knows to look for it, if you stick with it too long,
1126620	1129540	they're gonna look for it, they're gonna see it, it's gonna stand out.
1130380	1134760	Similarly, carrying data commands and ICMP echo, echo response packets,
1134760	1136820	same sort of, same sort of idea.
1137160	1143900	What I'm trying to do with this project is to automate this process and make it run on the fly
1143900	1150140	and may, and have it adapt itself to whatever network it's currently working on.
1150140	1154100	Look at what's going on on the network, decide what to do on the network,
1154100	1157300	decide what will work there, and then carry it out.
1159220	1165180	So, some aspects of network traffic are gonna have a low entropy,
1165180	1166580	meaning a very low randomness.
1166580	1171680	They're gonna be very kind of, the same thing's always gonna happen.
1171680	1175240	Certain communication protocols are only gonna go to certain computers.
1175280	1177780	DNS requests are only gonna go to your DNS servers.
1177780	1180280	They're not gonna be jumping around to every computer on your network.
1180860	1183700	Incoming web requests are probably only gonna come to your web server.
1183700	1185720	They're not gonna come to every computer on your network.
1186020	1188980	Other things are gonna look much more random.
1188980	1193660	Maybe outgoing web requests, you know, people, different people surfing the web,
1193660	1196540	outgoing FTP, all, all sorts of things.
1196540	1198300	Other things are gonna be very random.
1198300	1200460	There's gonna be a lot more entropy in that.
1201100	1205400	And entropy is the key to hiding information.
1205740	1208940	The, the more entropy you have on the system,
1208940	1212720	the more information you can hide in that.
1212720	1219280	This is like if you look at, if you look at steganography, for example,
1219280	1222080	you know, you're trying to hide information in something else.
1222080	1225020	If you've got a bitmap, a bitmap has lots and lots
1225020	1228940	of redundant information in it, versus a JPEG image.
1228940	1230440	A JPEG has taken a lot of that redundant information,
1231180	1233700	that's why a JPEG's smaller than a bitmap.
1233860	1237280	You can hide a lot more information than a bitmap than you can in a JPEG.
1237280	1240220	Higher entropy, you can hide more information inside it.
1240320	1245040	So, if we find what has the highest entropy on that network,
1245040	1248800	what communication channels have the highest degree of randomness,
1248800	1251040	we can then pick what we want to work in.
1251040	1254980	And we've got all sorts of, all sorts of things that we can work with here.
1254980	1258060	We can work with the timing of the packets, we can work with packets,
1258060	1260440	sending out packets that have bad checksums, malicious checksums,
1260460	1263860	malformed checksums, all sorts of different things that we can play with.
1263860	1268220	We don't have to use a SSH or a Telnet or some other standard type
1268220	1270180	of communication format.
1270180	1274660	We can send crafted packets where the information is carried in all sorts
1274660	1278040	of the different little pieces of information inside that packet.
1278040	1281420	The key is, we just have to make sure it doesn't look unusual
1281420	1283360	when that packet goes out.
1283680	1288780	So the overall concept here is we detect what the network baseline condition is.
1288780	1293060	On the specific network that we're looking at, what does normal look like?
1293060	1294680	What doesn't look unusual?
1295040	1298820	And then select from that the potential communication channels.
1298960	1303480	Determine which ones have highly random information on the network.
1303640	1307880	Trim it down, figure, we've got, initially we can select from anything.
1307880	1310440	We can craft a packet that does anything we want.
1310440	1313740	We're going to look at what happens on the network, figure out what's allowed,
1313740	1318400	limit it to that, and then limit it to what has a lot of entropy within that.
1318780	1322380	And then we have to somehow communicate this method to the receiver on the outside.
1322380	1327020	We have to get the information of what communication scheme we're going to use.
1327020	1329340	We have to get that to the receiver outside.
1329340	1333800	And then maintain a, you know, I put almost undetectable presence on the network.
1333920	1335900	You never should think you're undetectable.
1335900	1338140	You should never think anything's absolute, because it never is.
1338140	1340020	That's how you always get yourself into trouble.
1340300	1344520	But we can monitor and update the network conditions to stay hidden.
1344520	1348400	If network conditions change, we can change the scheme we're using to communicate.
1350240	1353160	On the network, if we just sit there and listen,
1353160	1355320	what can we learn by listening on the network?
1355320	1358420	There's all sorts of things that we can find
1358420	1361880	out by just sitting there and listening, not doing anything active,
1361880	1363780	not doing anything to be discovered.
1363780	1366620	You can figure out what types of packets are allowed inside the network,
1366620	1368820	what types of packets are allowed outside the network.
1368820	1371060	We can figure out the architecture of the network.
1371060	1371940	Where are the switches?
1371940	1373060	Where are the routers?
1373060	1375420	Where are other machines on this network?
1375540	1378640	And then look at what types of packets are flying around.
1378640	1381920	What types of packets does the machine that I'm on send and receive?
1381920	1385000	What types of packets do other machines out there send and receive?
1385000	1390240	And from this, get an idea of what is allowed to move around this network,
1390240	1395280	what is moving around this network, and what we can inject into the data flowing
1395280	1399400	around without being, without sticking out like a sore thumb
1399400	1401640	and being immediately identified.
1402800	1406480	So if we narrow down these choices, we start with the ability to send any type of packet,
1406480	1408360	you know, send it to any port whatsoever.
1408640	1411360	We start paring it down based on what's available,
1411360	1417600	figure out what has the highest entropy, look at this, look at the type of packets based
1417600	1420900	on the protocol, the ports they're using, et cetera,
1420900	1425180	and look at the entropy based on how often do these packets fly,
1425180	1428440	how different is the data in these packets whenever they go by,
1428440	1431160	what different machines do these types of packets go to,
1431160	1435660	and then pick a channel that we know we can get from point A to point B.
1435660	1438620	We can get from inside the network, we've got access to the machine network,
1438640	1443120	out of that network over to the place where we want to get the information to,
1443120	1445500	or back and forth, vice versa, either way.
1445500	1448940	We can figure out what can get into one, out of one network,
1448940	1451080	into another, and then back the other way.
1451080	1453920	It doesn't necessarily have to be a symmetric communication channel.
1453980	1458120	The packets that you send out, the packets that you send going out one way,
1458120	1461140	don't have to look a heck of a lot like the packets coming back in the other way.
1461160	1464580	As long as they're getting to the right segment on the network,
1464580	1467280	as long as they're getting down to the right branch off of your switch
1467280	1473600	so that it can be picked up by a, by a network card in promiscuous mode,
1473600	1477700	as long as you can get down that far and you know what to look for,
1477700	1480460	each guy on each end knows what to look for, you don't have
1480460	1482980	to have it even be a symmetric communication channel between them.
1482980	1487040	You can have essentially two different channels going back and forth.
1489040	1495380	One of the big challenges with this system is starting the conversation.
1495380	1498340	If you've got a piece of software running on the inside of this network
1498340	1500860	and it's gonna start communicating with you on the outside
1500860	1505740	and you don't know what particular communication scheme it's gonna be using,
1505740	1509220	there's some difficulties in getting, in getting that first packet out of there,
1509220	1513460	that first piece of information to the outside without having it be something
1513460	1515780	that can easily be written as a signature.
1515780	1520880	Because it's hard to, it's hard to change things or inject randomness
1521240	1523760	into the first bit of communication.
1523760	1530920	There's some, there's some ways that we can limit how signature vulnerable
1530920	1534360	that first bit of communication is, but that's one of, that is,
1534360	1537020	that's one of the points that needs,
1537020	1539700	that presents some challenge and needs some work on in this.
1540420	1543220	Having the communication software itself remain undetected
1543220	1545620	on the remote machine, not talking about what the software is doing,
1545620	1548520	but actually having the software itself avoid detection,
1548520	1549620	of course that's another challenge,
1549620	1552020	but that's a completely different story.
1552900	1557700	That's, whether it's something that's using a polymorphic code,
1557700	1561100	that is, that changes from one installation to another,
1561100	1563400	or even changes itself constantly.
1563400	1565400	There are ways around that, but it is a different,
1565400	1567960	but it is another challenge in there.
1568300	1571400	The third one, that's actually I think a fairly interesting one,
1571400	1573780	is the problem on a low entropy network.
1573820	1575400	What do you do when there's not a whole lot
1575400	1577540	of randomness going on on the network?
1578000	1580400	You know, if there's not a lot of randomness in the packets,
1580400	1582000	how do we stay hidden in it?
1582020	1583760	We have to ensure that every packet
1583760	1589520	that we send out doesn't significantly affect the statistical baseline
1589520	1592680	of the network, so that an anomaly detection system sat
1592680	1598500	on the network will not recognize this as something unusual.
1598500	1599560	It will not stand out.
1599560	1604260	It won't push the statistical analysis of the network beyond the limits,
1604260	1606180	beyond the thresholds that we currently have,
1606180	1608080	and it will avoid becoming an anomaly.
1608080	1612000	This is actually the area right now that I'm doing,
1612000	1618720	concentrating on, trying to figure out the best methods for communicating
1618720	1622940	and picking channels, and picking well-hidden channels
1622940	1625420	on a low entropy network.
1625540	1631200	So, just as a summary in the system, you know, what's real, what's not real,
1631200	1636840	so far the allowed protocols discovery, the network architecture discovery,
1636840	1641220	the statistical profiling of the network, those are,
1641220	1645880	those are working prototypes.
1645880	1648920	Those modules, those parts of the system are working prototypes.
1648920	1651100	Next stages that we're moving towards are the selection
1651100	1654500	of the communication scheme, implementation of the communication,
1654500	1659740	and the adaptation to changing network conditions.
1659920	1665420	I hope that by this time next year this will actually be a working package
1665840	1668480	that I can give maybe a bit better presentation and demonstration
1668980	1670180	of what it's actually doing.
1670180	1671200	But this is the current idea.
1671980	1676220	Anybody that has any interest in this, or any ideas, or feedback,
1676220	1679540	or wants to tell me why I'm crazy for thinking this, feel free.
1679540	1681260	There's my contact information.
1682300	1685780	And that's it for a, about a 25-minute presentation.
1693260	1694520	There's one question.
1703990	1706430	That, that's a, that is a great question.
1706870	1709730	I'll tell you, I'll take that just, I'll try and answer one more real quick.
1709730	1712250	He asked, is there any concept of trying
1712250	1716030	to actually change the baseline of the network so that you can do something
1716030	1719850	that used to look unusual, make it not look unusual anymore?
1719850	1723570	That is, it's not one of the first-level items on there.
1723570	1725870	That's a pretty advanced way of working it.
1725870	1729670	But actually changing, injecting stuff in slow enough that the system,
1729670	1732750	the anomaly detection system adapts to it and thinks that's normal,
1732750	1736730	that is one of the long-term ideas on there.
1736730	1740210	That's a great idea to put into this.
1740210	1778160	So, that's fair enough.
1778400	1780160	Thank you.
1782370	1783330	Sorry.