Publication Type
Conference Proceeding Article
Version
acceptedVersion
Publication Date
11-2016
Abstract
We address the challenge of detecting and addressing advanced persistent threats (APTs) in a computer network, focusing in particular on the challenge of detecting data exfiltration over Domain Name System (DNS) queries, where existing detection sensors are imperfect and lead to noisy observations about the network’s security state. Data exfiltration over DNS queries involves unauthorized transfer of sensitive data from an organization to a remote adversary through a DNS data tunnel to a malicious web domain. Given the noisy sensors, previous work has illustrated that standard approaches fail to satisfactorily rise to the challenge of detecting exfiltration attempts. Instead, we propose a decision-theoretic technique that sequentially plans to accumulate evidence under uncertainty while taking into account the cost of deploying such sensors. More specifically, we provide a fast scalable POMDP formulation to address the challenge, where the efficiency of the formulation is based on two key contributions: (i) we use a virtually distributed POMDP (VD-POMDP) formulation, motivated by previous work in distributed POMDPs with sparse interactions, where individual policies for different sub-POMDPs are planned separately but their sparse interactions are only resolved at execution time to determine the joint actions to perform; (ii) we allow for abstraction in planning for speedups, and then use a fast MILP to implement the abstraction while resolving any interactions. This allows us to determine optimal sensing strategies, leveraging information from many noisy detectors, and subject to constraints imposed by network topology, forwarding rules and performance costs on the frequency, scope and efficiency of sensing we can perform.
Discipline
Databases and Information Systems
Research Areas
Data Science and Engineering
Publication
Proceedings of Decision and Game Theory for Security
Volume
9996
ISBN
978-3-319-47412-0
Identifier
10.1007/978-3-319-47413-7_3
City or Country
New York, USA
Citation
MC CARTHY, Sara Marie; SINHA, Arunesh; TAMBE, Milind; and MANADHATA, Pratyusa.
Data exfiltration detection and prevention: Virtually distributed POMDPs for practically safer networks. (2016). Proceedings of Decision and Game Theory for Security. 9996,.
Available at: https://ink.library.smu.edu.sg/sis_research/4665
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Additional URL
https://doi.org/10.1007/978-3-319-47413-7_3